CVE-2026-31766

drm/amdgpu: validate doorbell_offset in user queue creation

State: Published
Severity: 7.1 High
Published: May 1, 2026
Updated: Aug 5, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate doorbell_offset in user queue creation

amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow.

(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before 3543005a42d7e8e12b21897ef6798541bf7cbcd3Affected f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before 86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6Affected f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 to before a018d1819f158991b7308e4f74609c6c029b670cAffected
LinuxLinux	6.16Affected before 6.16Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.Not affected 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.