Skip to main content

Linux Kernel EUVDEUVD-2026-32826

| CVE-2026-46199 HIGH
Out-of-bounds Read (CWE-125)
2026-05-28 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-v7cw-36xw-548q
Linux Information Disclosure Buffer Overflow
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
May 30, 2026 - 12:04 vuln.today
CVSS changed
May 30, 2026 - 11:22 NVD
7.1 (HIGH)
Patch available
May 28, 2026 - 12:01 EUVD
CVE Published
May 28, 2026 - 10:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 28, 2026 - 10:16 nvd
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

Check bounds against the end of the BO whenever we access the msg.

AnalysisAI

Out-of-bounds read in the AMD GPU VCN4 (Video Core Next, 4th generation) decoder message parser of the Linux kernel allows a local low-privileged user to read kernel memory beyond the decoder message buffer object, potentially leading to information disclosure and denial of service. The flaw exists in the drm/amdgpu/vcn4 driver where bounds against the end of the buffer object (BO) were not validated when parsing decoder messages. No public exploit identified at time of analysis and EPSS scores the exploitation probability at just 0.02% (6th percentile), but a vendor patch is available across multiple stable branches.

Technical ContextAI

The vulnerability resides in the AMD GPU (amdgpu) Direct Rendering Manager (DRM) kernel driver, specifically in the Video Core Next 4 (VCN4) hardware video decoder support code. VCN is AMD's unified video encode/decode engine present in modern Radeon GPUs and APUs, and userspace clients submit decode messages to the kernel via the DRM IOCTL interface backed by GPU buffer objects (BOs). When the driver parsed these decoder messages, it accessed fields without consistently checking that the read offsets remained within the bounds of the underlying BO, producing an out-of-bounds read on adjacent kernel memory. While the CVE entry lists CWE as N/A, the defect is functionally a classic CWE-125 (Out-of-bounds Read) reachable from a local DRM client.

RemediationAI

Upstream fix available (commits 63b51e8a9d54, 0a78f2bac142, 7688143ca62e, c72a8b4dc6d5, 3c817a60b09e) and released in stable kernels 6.6.140, 6.12.90, 6.18.32, 7.0.9, and mainline 7.1-rc1 - upgrade to one of these patched versions or to the equivalent distribution-vendor kernel that backports the amdgpu/vcn4 bounds check; the patches are linked from https://git.kernel.org/stable/c/63b51e8a9d54317d31cc3856c1e12407070d5fc2 and the other commit references in the NVD advisory. As a compensating control until patched, restrict local DRM render-node access (/dev/dri/renderD*) to trusted users via group permissions or systemd seat assignments, disable hardware-accelerated video decode in containerized or multi-tenant workloads that expose VCN4 to untrusted users, and avoid sharing the GPU device into untrusted VMs or sandboxes; these mitigations come at the cost of losing hardware video decode acceleration for the affected workloads and may break browser GPU sandboxes, Wayland compositors, or media playback for non-privileged users.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2016-1646 HIGH POC
8.8
CVE-2025-5777 HIGH POC
7.5
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-32826 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy