CVE-2026-80576

drm/amdgpu: reject oversized IBs with per-ring packet limits

State: Published
Severity: 8.8 High
Published: Aug 26, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: reject oversized IBs with per-ring packet limits

On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission.

Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types.

(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before ecdaefe825555f133a2ef80f39d1ae94d6e1b26aAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 67a5d905c17a5066b0f6f950da11da93d56d122bAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 6e164ba1057175fb8a370d8e05cbff5c57eac0c8Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1474f3970d1afd303e12ff14d06808eabb371576Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 07fe270ec07c138a70afe7a81e115a85c35c545cAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before fd37f9dd5b5ab70a46fa7bc76623c0528d602b27Affected
LinuxLinux	4.2Affected before 4.2Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.105 through 6.12.Not affected 6.18.46 through 6.18.Not affected 7.1.10 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before ecdaefe825555f133a2ef80f39d1ae94d6e1b26aAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 67a5d905c17a5066b0f6f950da11da93d56d122bAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 6e164ba1057175fb8a370d8e05cbff5c57eac0c8Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1474f3970d1afd303e12ff14d06808eabb371576Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 07fe270ec07c138a70afe7a81e115a85c35c545cAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before fd37f9dd5b5ab70a46fa7bc76623c0528d602b27Affected

LinuxLinux

4.2Affected
before 4.2Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.105 through 6.12.*Not affected
6.18.46 through 6.18.*Not affected
7.1.10 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.