CVE-2026-89818
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
How to fix
- Linux Linuxc2340281be4ddacb8c203e2bce59b126d1d6c4c8, 6dceaeceaa7c8396339f3ea34b0110cb912ca61b, 47799e1f893d47d8af231710a61065e3ec8a13e8, 7e28853c78c20bb8ba4c1dba702430cd05e09f76, 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3, 4d7390530853eb7befda9cc786e4c86e8ad7ac9e, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 5.16, 7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 88411caee8f576d6b5abf6531232fcc0ce756dc5 ≤ v < c2340281be4ddacb8c203e2bce59b126d1d6c4c8, c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e ≤ v < 6dceaeceaa7c8396339f3ea34b0110cb912ca61b, 7688143ca62edeecacb3ba0a2cea129dbd262a18 ≤ v < 47799e1f893d47d8af231710a61065e3ec8a13e8, 63b51e8a9d54317d31cc3856c1e12407070d5fc2 ≤ v < 7e28853c78c20bb8ba4c1dba702430cd05e09f76, b193019860d61e92da395eae2011f2f6716b182f ≤ v < 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3, b193019860d61e92da395eae2011f2f6716b182f ≤ v < 4d7390530853eb7befda9cc786e4c86e8ad7ac9e, f55552adb100eb54a6e6dabff4fbdc8679bd3fa0, 82c535eff05490c71153af57de9fe85502fcb5d5, 638d3e0b9eb77aa53fdd60e2b928761d16ba76fa, 870c8738c3774336baedddd0240951d078a703b8, 638e48ee39d0f2af9336f917a6f5d6692dd64d93, e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7, 3c817a60b09eaab926e475088e750936efcc95ae, 6.1.175 ≤ v < 6.1.188, 6.6.140 ≤ v < 6.6.157, 6.12.90 ≤ v < 6.12.110, 6.18.32 ≤ v < 6.18.51, 5.15.209 ≤ v < 5.16, 7.0.9 ≤ v < 7.1, 7.1 | c2340281be4ddacb8c203e2bce59b126d1d6c4c8, 6dceaeceaa7c8396339f3ea34b0110cb912ca61b, 47799e1f893d47d8af231710a61065e3ec8a13e8, 7e28853c78c20bb8ba4c1dba702430cd05e09f76, 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3, 4d7390530853eb7befda9cc786e4c86e8ad7ac9e, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 5.16, 7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.