CVE-2026-80576
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
43/100
Published: 2026-08-26
Modified: 2026-10-30
First seen: 2026-10-30
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
Scope Change
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Changed
C:
High
I:
High
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < ecdaefe825555f133a2ef80f39d1ae94d6e1b26a |
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 67a5d905c17a5066b0f6f950da11da93d56d122b |
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8 |
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 1474f3970d1afd303e12ff14d06808eabb371576 |
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 07fe270ec07c138a70afe7a81e115a85c35c545c |
| Linux | Linux | d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27 |
| Linux | Linux | 4.2 |