CVE-2026-80541
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
How to fix
- Linux Linux5c73485af7ad9c3ae592db3481f370bc07705391, 584e3d47736fe2e7184ef3fc16b00b41485f96c6, 66133fc05c3af002f45de8a71b833c026ccbfba6, ce5da474c3ddf7cccec5dce6aa4296297dd7caff, 493355096e397f9217b41c8574ed2784c7351443, 220aa2589d7321fb68d2e8597862711b5f22ae0b, 80f0b53860d02577709d69a312a29ca674b9297c, 5e9d136ad74df4edec67e502ce267597064d8f86 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 5c73485af7ad9c3ae592db3481f370bc07705391, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 584e3d47736fe2e7184ef3fc16b00b41485f96c6, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 66133fc05c3af002f45de8a71b833c026ccbfba6, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < ce5da474c3ddf7cccec5dce6aa4296297dd7caff, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 493355096e397f9217b41c8574ed2784c7351443, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 220aa2589d7321fb68d2e8597862711b5f22ae0b, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 80f0b53860d02577709d69a312a29ca674b9297c, 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd ≤ v < 5e9d136ad74df4edec67e502ce267597064d8f86, 4.20 | 5c73485af7ad9c3ae592db3481f370bc07705391, 584e3d47736fe2e7184ef3fc16b00b41485f96c6, 66133fc05c3af002f45de8a71b833c026ccbfba6, ce5da474c3ddf7cccec5dce6aa4296297dd7caff, 493355096e397f9217b41c8574ed2784c7351443, 220aa2589d7321fb68d2e8597862711b5f22ae0b, 80f0b53860d02577709d69a312a29ca674b9297c, 5e9d136ad74df4edec67e502ce267597064d8f86 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.