GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80576 (GCVE-0-2026-80576)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
drm/amdgpu: reject oversized IBs with per-ring packet limits
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 1474f3970d1afd303e12ff14d06808eabb371576 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 07fe270ec07c138a70afe7a81e115a85c35c545c (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e164ba1057175fb8a370d8e05cbff5c57eac0c8",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "1474f3970d1afd303e12ff14d06808eabb371576",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "07fe270ec07c138a70afe7a81e115a85c35c545c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "fd37f9dd5b5ab70a46fa7bc76623c0528d602b27",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: reject oversized IBs with per-ring packet limits\n\nOn GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through\nto ib-\u003elength_dw without a limit, while ring_emit_ib() encodes length\ninto packet fields. Oversized values can corrupt adjacent control bits\nand destabilize command submission.\n\nAdd a per-ring IB packet size limit helper and reject command\nsubmissions exceeding the corresponding dword limit before IB\nallocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,\nand apply the MM fallback limit for other ring types.\n\n(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the AMDGPU_CS DRM ioctl on a local /dev/dri/renderD* render node; amdgpu_cs_p2_ib() takes user-supplied ib_bytes from command-submission chunks during local GPU job setup, with no network, adjacent-radio, or physical-access path to this code.\nAC:L - An attacker fully controls ib_bytes, ring selection, and backing BO mappings in each submit; triggering the flaw only requires one crafted IB chunk with length_dw above the hardware 20-bit packet limit (e.g., \u003e0xFFFFF dwords), with no race or victim-dependent timing.\nPR:L - AMDGPU_CS is registered with DRM_AUTH|DRM_RENDER_ALLOW, so any authenticated render-client process with standard local access to /dev/dri/renderD* (typical render/video group on desktops, gaming PCs, and cloud GPU VMs) can reach amdgpu_cs_ioctl() without real root or init-namespace capabilities.\nUI:N - Exploitation is entirely self-contained in the attacker\u0027s own DRM client (open render node, allocate/map buffers, submit CS); no separate victim action such as opening a file, mounting a filesystem, or clicking a link is required.\nS:C - On GFX/compute rings, ring_emit_ib() ORs ib-\u003elength_dw into the INDIRECT_BUFFER control dword alongside VMID and preempt/valid bits; oversized values spill into those fields, so the GPU can execute IBs under an unintended VMID and perform DMA outside the attacker\u0027s GPU virtual address space, crossing per-client GPU/IOMMU isolation (e.g., multi-tenant cloud GPU).\nC:H - Corrupted VMID and adjacent control bits in the INDIRECT_BUFFER packet can redirect GPU fetches/execution into another client\u0027s GPU-mapped memory, providing a cross-context read primitive beyond the attacker\u0027s own BO mappings, not merely a benign driver error return.\nI:H - The same control-dword overflow can alter VALID/PREEMPT/VMID encoding so the GPU performs writes and command execution in an unintended address space, yielding cross-context memory corruption and a plausible path to arbitrary GPU-visible memory modification or further kernel compromise.\nA:H - Oversized IB lengths also destabilize command submission and can hang or reset GFX/SDMA rings (as noted in the fix and related IGT oversize-packet tests), denying GPU/display availability until driver reset or reboot on affected AMD systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:58.528Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576"
        },
        {
          "url": "https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27"
        }
      ],
      "title": "drm/amdgpu: reject oversized IBs with per-ring packet limits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80576",
    "datePublished": "2026-08-26T14:37:35.538Z",
    "dateReserved": "2026-08-26T14:34:25.768Z",
    "dateUpdated": "2026-08-27T05:01:58.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80576",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02058"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:09:23.000Z",
      "cve": "CVE-2026-80576",
      "id": "msrc_CVE-2026-80576",
      "initial_release_date": "2026-08-27T01:09:23.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: reject oversized IBs with per-ring packet limits",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80576.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80576\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:13.653\",\"lastModified\":\"2026-08-27T06:17:43.533\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: reject oversized IBs with per-ring packet limits\\n\\nOn GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through\\nto ib-\u003elength_dw without a limit, while ring_emit_ib() encodes length\\ninto packet fields. Oversized values can corrupt adjacent control bits\\nand destabilize command submission.\\n\\nAdd a per-ring IB packet size limit helper and reject command\\nsubmissions exceeding the corresponding dword limit before IB\\nallocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,\\nand apply the MM fallback limit for other ring types.\\n\\n(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"6e164ba1057175fb8a370d8e05cbff5c57eac0c8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"1474f3970d1afd303e12ff14d06808eabb371576\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"07fe270ec07c138a70afe7a81e115a85c35c545c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"fd37f9dd5b5ab70a46fa7bc76623c0528d602b27\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T06:35:12+00:00",
      "cve": "CVE-2026-80576",
      "id": "CVE-2026-80576",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: reject oversized IBs with per-ring packet limits",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80576.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-04T00:22:19Z",
      "cve": "CVE-2026-80576",
      "id": "CVE-2026-80576",
      "initial_release_date": "2026-08-27T00:11:33Z",
      "product_status:known_affected": "282",
      "product_status:known_not_affected": "71",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80576",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80576.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.