EUVD-2026-66456
GHSA-6pqc-pjg3-fqrx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access via DRI node with low privileges required; out-of-bounds kernel write could enable privilege escalation beyond the confirmed panic.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate GEM_CREATE domain combinations
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON().
Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl().
v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian)
(cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
AnalysisAI
Local privilege escalation and kernel panic in the Linux kernel AMDGPU DRM subsystem allows a low-privileged local user to crash the system or potentially corrupt kernel memory by submitting a crafted GEM_CREATE ioctl with invalid domain flag combinations. The AMDGPU_GEM_CREATE ioctl validated individual domain bits against AMDGPU_GEM_DOMAIN_MASK but failed to reject illegal combinations of CPU, GTT, or VRAM domains mixed with special-purpose domains (DOORBELL, GDS, GWS, OA), causing amdgpu_bo_placement_from_domain() to write past the AMDGPU_BO_MAX_PLACEMENTS array boundary and trigger BUG_ON(), resulting in a kernel panic. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a Linux system with AMD GPU hardware present and the amdgpu kernel module loaded; (2) local execution access with at least standard user privileges (PR:L); (3) read/write access to an AMD DRI render node (typically /dev/dri/renderD128), which is granted by default to members of the 'video' or 'render' group on most distributions, or to any process inside a container with GPU passthrough. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) reflects a local attacker with standard user privileges (PR:L) who can reliably (AC:L) trigger the vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user or container workload with access to an AMD GPU render node (/dev/dri/renderD128) opens the device and issues a GEM_CREATE ioctl with a domain bitmask that combines AMDGPU_GEM_DOMAIN_VRAM|AMDGPU_GEM_DOMAIN_GTT|AMDGPU_GEM_DOMAIN_CPU|AMDGPU_GEM_DOMAIN_DOORBELL. The kernel processes the combined mask in amdgpu_bo_placement_from_domain(), emits more placement entries than AMDGPU_BO_MAX_PLACEMENTS, and hits BUG_ON(), crashing the host kernel and causing a denial of service for all users. … |
| Remediation | The primary fix is to upgrade to a patched stable kernel release: 5.10.266 or later, 5.15.217 or later, 6.1.184 or later, 6.6.153 or later, 6.12.105 or later, 6.18.46 or later, 7.1.10 or later, or 7.2 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems with AMDGPU drivers (workstations, graphics servers) and categorize by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today