CVE-2026-80576drm/amdgpu: reject oversized IBs with per-ring packet limits
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 6e164ba1057175fb8a370d8e05cbff5c57eac0c8; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 1474f3970d1afd303e12ff14d06808eabb371576; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 07fe270ec07c138a70afe7a81e115a85c35c545c; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before fd37f9dd5b5ab70a46fa7bc76623c0528d602b27 | CNA record |
References
- https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8
- https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576
- https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c
- https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.