7.1

CVE-2026-89818

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression
6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting
the parser loop far past the end of the message BO. Triggering it
additionally requires a ~4GiB mapping so that msg[1] survives the
earlier "header does not fit in BO" check.

Rewrite the test in division form, which is overflow-free by
construction. Also update the message to reflect that msg is invalid.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 88411caee8f576d6b5abf6531232fcc0ce756dc5
Version < c2340281be4ddacb8c203e2bce59b126d1d6c4c8
Status affected
Version c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e
Version < 6dceaeceaa7c8396339f3ea34b0110cb912ca61b
Status affected
Version 7688143ca62edeecacb3ba0a2cea129dbd262a18
Version < 47799e1f893d47d8af231710a61065e3ec8a13e8
Status affected
Version 63b51e8a9d54317d31cc3856c1e12407070d5fc2
Version < 7e28853c78c20bb8ba4c1dba702430cd05e09f76
Status affected
Version b193019860d61e92da395eae2011f2f6716b182f
Version < 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3
Status affected
Version b193019860d61e92da395eae2011f2f6716b182f
Version < 4d7390530853eb7befda9cc786e4c86e8ad7ac9e
Status affected
Version f55552adb100eb54a6e6dabff4fbdc8679bd3fa0
Status affected
Version 82c535eff05490c71153af57de9fe85502fcb5d5
Status affected
Version 638d3e0b9eb77aa53fdd60e2b928761d16ba76fa
Status affected
Version 870c8738c3774336baedddd0240951d078a703b8
Status affected
Version 638e48ee39d0f2af9336f917a6f5d6692dd64d93
Status affected
Version e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7
Status affected
Version 3c817a60b09eaab926e475088e750936efcc95ae
Status affected
Version 6.1.175
Version < 6.1.188
Status affected
Version 6.6.140
Version < 6.6.157
Status affected
Version 6.12.90
Version < 6.12.110
Status affected
Version 6.18.32
Version < 6.18.51
Status affected
Version 5.15.209
Version < 5.16
Status affected
Version 7.0.9
Version < 7.1
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 7.1
Status affected
Version 0
Version < 7.1
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.51
Status unaffected
Version <= 7.2.*
Version 7.2.5
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.055
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/c2340281be4ddacb8c203e2bce59b126d1d6c4c8
https://git.kernel.org/stable/c/6dceaeceaa7c8396339f3ea34b0110cb912ca61b
https://git.kernel.org/stable/c/47799e1f893d47d8af231710a61065e3ec8a13e8
https://git.kernel.org/stable/c/7e28853c78c20bb8ba4c1dba702430cd05e09f76
https://git.kernel.org/stable/c/9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3
https://git.kernel.org/stable/c/4d7390530853eb7befda9cc786e4c86e8ad7ac9e