Riskcovery

CVE-2026-64516

drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets

State
Published
Severity
8.8 High
Published
Jul 25, 2026
Updated
Aug 5, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets

The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access.

Make sure the stack and data offsets are aligned to the 32K TLB size.

Check that the FW microcode actually fits in the space that is reserved for it.

(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f to before ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4Affected
  • d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f to before 3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3Affected
LinuxLinux
  • 6.19Affected
  • before 6.19Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.