EUVD-2026-66491
GHSA-mv2f-pcc7-qh27
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Local render node access requires PR:L; AC:L as no special race or configuration applies; S:C reflects ring corruption affecting shared kernel GPU state beyond attacker's process.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: reject oversized IBs with per-ring packet limits
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission.
Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types.
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
AnalysisAI
Missing bounds validation in the amdgpu DRM driver's GFX ring command submission path allows a local low-privileged user to submit oversized Indirect Buffer (IB) requests that corrupt adjacent control bits in GPU ring packet fields, destabilizing command submission and potentially achieving kernel memory corruption with scope-changing impact. Affected systems must have AMD GPU hardware and the amdgpu kernel module loaded; the vulnerability is present across multiple stable branches prior to Linux 6.12.105, 7.1.10, 6.18.46, and 7.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user-level account (PR:L) on a system running an unpatched Linux kernel with AMD GPU hardware present and the amdgpu kernel module loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a technically credible severity: exploitation is low-complexity and requires only a user-level shell on a system with an AMD GPU, with no user interaction needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with render group membership on an AMD GPU host opens the DRM render node (/dev/dri/renderD128) and submits a crafted DRM_IOCTL_AMDGPU_CS command buffer with an IB size value exceeding the 20-bit GFX packet field limit. The oversized value passes through amdgpu_cs_p2_ib() without rejection, and when encoded into the ring packet by ring_emit_ib(), it overflows into adjacent control bits in the GPU command ring. … |
| Remediation | The primary remediation is to upgrade the Linux kernel to a patched stable release: 6.12.105, 7.1.10, 6.18.46, or 7.2, corresponding to upstream commits available at git.kernel.org/stable (6e164ba1, 1474f397, 07fe270e, fd37f9dd). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems with AMD GPU hardware and determine their kernel versions to establish affected system count. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today