CVE-2026-74417drm/radeon: fix integer overflow in radeon_align_pitch()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon_align_pitch() radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int. If that wraps, radeon_mode_dumb_create() can end up returning an invalid pitch or creating a zero-sized dumb buffer. Fix this by using check_add_overflow() for the alignment round-up and check_mul_overflow() for the final pitch calculation, returning 0 on overflow. Also reject zero pitch and size in radeon_mode_dumb_create(). Found via AST-based call-graph analysis using sqry.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ff72145badb834e8051719ea66e024784d000cb4 before b7b44937c548c2c987fcdd129f8896741004bed6; from ff72145badb834e8051719ea66e024784d000cb4 before 415bb9893e249e46aa5159f7363a11512cf06fa9; from ff72145badb834e8051719ea66e024784d000cb4 before d9dfa176899d488e48bb7342d2c43ddd36e66318; from ff72145badb834e8051719ea66e024784d000cb4 before dfc7b5b5599472277e71e5bd2712740651c7c5be; from ff72145badb834e8051719ea66e024784d000cb4 before ce3b24eb3ee8f82de851535f516bf21f83e82259 | CNA record |
References
- https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6
- https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9
- https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318
- https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be
- https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.