CVE-2026-80541drm/amdgpu: validate GEM_CREATE domain combinations
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd builds before 5c73485af7ad9c3ae592db3481f370bc07705391; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before 584e3d47736fe2e7184ef3fc16b00b41485f96c6; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before 66133fc05c3af002f45de8a71b833c026ccbfba6; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before ce5da474c3ddf7cccec5dce6aa4296297dd7caff; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before 493355096e397f9217b41c8574ed2784c7351443; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before 220aa2589d7321fb68d2e8597862711b5f22ae0b; from 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd before 80f0b53860d02577709d69a312a29ca674b9297c; 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd builds before 5e9d136ad74df4edec67e502ce267597064d8f86 | CNA record |
References
- https://git.kernel.org/stable/c/5c73485af7ad9c3ae592db3481f370bc07705391
- https://git.kernel.org/stable/c/584e3d47736fe2e7184ef3fc16b00b41485f96c6
- https://git.kernel.org/stable/c/66133fc05c3af002f45de8a71b833c026ccbfba6
- https://git.kernel.org/stable/c/ce5da474c3ddf7cccec5dce6aa4296297dd7caff
- https://git.kernel.org/stable/c/493355096e397f9217b41c8574ed2784c7351443
- https://git.kernel.org/stable/c/220aa2589d7321fb68d2e8597862711b5f22ae0b
- https://git.kernel.org/stable/c/80f0b53860d02577709d69a312a29ca674b9297c
- https://git.kernel.org/stable/c/5e9d136ad74df4edec67e502ce267597064d8f86
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.