HIGH
amdgpu DecMsg Overflow
CVE-2026-89818
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI7.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
02KernelScan AI Analysis
Risk summary
A local user with access to an AMD GPU render node can submit a crafted VCN decode message that bypasses a bounds check via integer overflow, causing the kernel parser to read far past the end of the graphics buffer. This can leak kernel memory and potentially corrupt memory through GPU DMA operations, or crash the kernel. Systems without AMD VCN GPUs are unaffected.
Vulnerability analysis
A bounds check in the AMD VCN video-decode message parser multiplies the attacker-supplied buffer count by four and adds six; when the count is very large the result wraps around to a small value, the check passes, and the parser loops far past the end of the graphics memory buffer object, reading out-of-bounds kernel memory. The fix rewrites the same test using division instead of multiplication, which cannot overflow, and adds a minimum-length guard so that malformed messages are rejected outright. A local user with access to the AMD GPU render device can trigger this by submitting a crafted decode message through the command-submission ioctl; the attack requires an AMD GPU with VCN support and a roughly 4 GiB memory mapping to satisfy an earlier sanity check.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1.175 | 6.1.188 | c2340281be4d |
| 6.6 | 6.6.140 | 6.6.157 | 6dceaeceaa7c |
| 6.12 | 6.12.90 | 6.12.110 | 47799e1f893d |
| 5.15 | 5.15.209 | 5.16 | 9ae19bd60891 |
| 7.0 | 7.0.9 | 7.1 | 4d7390530853 |
| 7.2 | — | 7.2.5 | — |
| mainline | — | 7.3-rc1 | — |
| 6.18 | 6.18.32 | 6.18.51 | 7e28853c78c2 |
| cip/6.12 | — | 6.12.111-cip32 | 47799e1f893d |