CVE-2026-89818

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

State: Published
Severity: 7.1 High
Published: Sep 16, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check.

Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	88411caee8f576d6b5abf6531232fcc0ce756dc5 to before c2340281be4ddacb8c203e2bce59b126d1d6c4c8Affected c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e to before 6dceaeceaa7c8396339f3ea34b0110cb912ca61bAffected 7688143ca62edeecacb3ba0a2cea129dbd262a18 to before 47799e1f893d47d8af231710a61065e3ec8a13e8Affected 63b51e8a9d54317d31cc3856c1e12407070d5fc2 to before 7e28853c78c20bb8ba4c1dba702430cd05e09f76Affected b193019860d61e92da395eae2011f2f6716b182f to before 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3Affected b193019860d61e92da395eae2011f2f6716b182f to before 4d7390530853eb7befda9cc786e4c86e8ad7ac9eAffected f55552adb100eb54a6e6dabff4fbdc8679bd3fa0Affected 82c535eff05490c71153af57de9fe85502fcb5d5Affected 638d3e0b9eb77aa53fdd60e2b928761d16ba76faAffected 870c8738c3774336baedddd0240951d078a703b8Affected 638e48ee39d0f2af9336f917a6f5d6692dd64d93Affected e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7Affected 3c817a60b09eaab926e475088e750936efcc95aeAffected 6.1.175 to before 6.1.188Affected 6.6.140 to before 6.6.157Affected 6.12.90 to before 6.12.110Affected 6.18.32 to before 6.18.51Affected 5.15.209 to before 5.16Affected 7.0.9 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.51 through 6.18.Not affected 7.2.5 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

88411caee8f576d6b5abf6531232fcc0ce756dc5 to before c2340281be4ddacb8c203e2bce59b126d1d6c4c8Affected
c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e to before 6dceaeceaa7c8396339f3ea34b0110cb912ca61bAffected
7688143ca62edeecacb3ba0a2cea129dbd262a18 to before 47799e1f893d47d8af231710a61065e3ec8a13e8Affected
63b51e8a9d54317d31cc3856c1e12407070d5fc2 to before 7e28853c78c20bb8ba4c1dba702430cd05e09f76Affected
b193019860d61e92da395eae2011f2f6716b182f to before 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3Affected
b193019860d61e92da395eae2011f2f6716b182f to before 4d7390530853eb7befda9cc786e4c86e8ad7ac9eAffected
f55552adb100eb54a6e6dabff4fbdc8679bd3fa0Affected
82c535eff05490c71153af57de9fe85502fcb5d5Affected
638d3e0b9eb77aa53fdd60e2b928761d16ba76faAffected
870c8738c3774336baedddd0240951d078a703b8Affected
638e48ee39d0f2af9336f917a6f5d6692dd64d93Affected
e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7Affected
3c817a60b09eaab926e475088e750936efcc95aeAffected
6.1.175 to before 6.1.188Affected
6.6.140 to before 6.6.157Affected
6.12.90 to before 6.12.110Affected
6.18.32 to before 6.18.51Affected
5.15.209 to before 5.16Affected
7.0.9 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.51 through 6.18.*Not affected
7.2.5 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.