CVE-2026-68108

drm/amdgpu/vce: fix integer overflow in image size

State: Published
Severity: 8.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce: fix integer overflow in image size

Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access.

The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware.

V2: remove redundant check V3: modify max height value V4: remove size64

(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 893db20383800cfe92e638705984eebb13bc81a5Affected f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before a07430abd556de3707adfcadcc60db3fa64e4b2bAffected f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before a6d7065b91a14790980ce6f4960db0ca8c3c9940Affected f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 7eebef042c12dfe0568593ee6a8926d16505925eAffected f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 00c311a13d225266800c712f2b7db2711c6897deAffected f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 186bfdc4e26d019b2e7570cb121964a1d89b2e5bAffected
LinuxLinux	4.2Affected before 4.2Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 893db20383800cfe92e638705984eebb13bc81a5Affected
f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before a07430abd556de3707adfcadcc60db3fa64e4b2bAffected
f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before a6d7065b91a14790980ce6f4960db0ca8c3c9940Affected
f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 7eebef042c12dfe0568593ee6a8926d16505925eAffected
f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 00c311a13d225266800c712f2b7db2711c6897deAffected
f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c to before 186bfdc4e26d019b2e7570cb121964a1d89b2e5bAffected

LinuxLinux

4.2Affected
before 4.2Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.