HIGH Introduced in 4.20
amdgpu GemCreate Panic
CVE-2026-80541
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
02KernelScan AI Analysis
Risk summary
A local user with access to the AMDGPU DRM device can trigger a kernel BUG_ON by passing invalid domain combinations to the GEM_CREATE ioctl, causing a kernel panic and denial of service. The fix adds validation to reject invalid domain combinations early.
Vulnerability analysis
The driver did not check whether memory domain flags were combined in valid ways. A caller could mix incompatible domain types, which caused an internal array to exceed its fixed limit and triggered a kernel panic. The fix now rejects invalid combinations early and only permits certain domains to be used together. Any local user with access to the graphics device can trigger this.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.20 | 5.15.217 | 584e3d47736f |
| 6.1 | 4.20 | 6.1.184 | 66133fc05c3a |
| 6.12 | 4.20 | 6.12.105 | 493355096e39 |
| 6.18 | 4.20 | 6.18.46 | 220aa2589d73 |
| mainline | 4.20 | 7.2 | 5e9d136ad74d |
| 5.10 | 4.20 | 5.10.266 | 5c73485af7ad |
| 7.1 | 4.20 | 7.1.10 | 80f0b53860d0 |
| 6.6 | 4.20 | 6.6.153 | ce5da474c3dd |
| cip/4.19 | 4.20 | 4.19.325-cip136 | 0ba9d59732f0 |
| cip/4.19-rt | 4.20 | 4.19.325-cip136-rt50 | 0ba9d59732f0 |
| cip/5.10 | 4.20 | 5.10.268-cip77 | 5c73485af7ad |
| cip/5.10-rt | 4.20 | 5.10.268-cip77-rt34 | 5c73485af7ad |
| cip/6.1 | 4.20 | 6.1.187-cip60 | 66133fc05c3a |
| cip/6.12 | 4.20 | 6.12.108-cip31 | 493355096e39 |