Skip to main content

Linux Kernel EUVDEUVD-2026-55489

| CVE-2026-68108 HIGH
2026-08-10 Linux GHSA-34qj-qvm5-mprq
Buffer Overflow Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Local vector and low privilege reflect mandatory authenticated shell access and DRM node access; scope change captures GPU firmware memory impact outside the kernel component.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:16 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce: fix integer overflow in image size

Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access.

The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware.

V2: remove redundant check V3: modify max height value V4: remove size64

(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

AnalysisAI

Integer overflow in the Linux kernel's drm/amdgpu VCE (Video Codec Engine) driver enables local low-privileged users on systems with AMD GPU hardware to corrupt GPU memory. Crafted VCE command streams containing extreme image dimensions such as 65536×65536 pixels trigger a 32-bit arithmetic overflow, collapsing the computed buffer size to zero, which bypasses bounds validation and permits the GPU firmware to perform out-of-bounds memory access with scope-change implications rated CVSS 8.8. No public exploit code has been identified and EPSS stands at 0.18% (7th percentile), indicating low real-world exploitation activity; the high score reflects the full-impact scope change to GPU firmware memory rather than immediate internet-facing risk.

Technical ContextAI

The vulnerability resides in the drm/amdgpu subsystem of the Linux kernel, specifically in the VCE (Video Codec Engine) command stream parser. VCE is AMD's dedicated hardware video encode block, accessible to user-space through the Direct Rendering Manager (DRM) interface. The root cause is unsigned 32-bit integer multiplication of width and height dimensions without overflow guards - a classic CWE-190 (Integer Overflow or Wraparound) pattern: multiplying 65536 × 65536 in 32-bit arithmetic yields exactly zero due to wrap-around, causing the derived allocation or validation size to be treated as zero. This bypasses any downstream bounds checking and allows the GPU firmware to operate on an incorrectly sized buffer, producing out-of-bounds memory access consistent with CWE-787. The fix replaces the 32-bit computation with 64-bit arithmetic and rejects dimensions that would overflow before they reach the hardware. Affected CPE is cpe:2.3:a:linux:linux across multiple stable branches, confirmed by EUVD-2026-55489 and five upstream kernel.org commit references.

RemediationAI

The primary remediation is to update the Linux kernel to one of the vendor-released patched stable versions: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 on the respective stable branches, or 7.2-rc2 on mainline. Patch commits are publicly available at the kernel.org stable repository across five confirmed commits (representative references include https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b and https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b). Distribution-packaged kernels should receive backported fixes through vendor security channels - consult your distribution's security tracker. If an immediate kernel upgrade is not feasible, a compensating control is to restrict access to AMD GPU DRM render device nodes (typically /dev/dri/renderD* paths) via udev rules or tightened file permissions, limiting which users may submit VCE command streams; note this will break GPU-accelerated video encoding for restricted users. Disabling the amdgpu kernel module entirely eliminates the attack surface at the cost of all AMD GPU functionality.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55489 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy