Home

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. (cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)

PUBLISHED Reserved 2026-03-09 | Published 2026-05-01 | Updated 2026-05-03 | Assigner Linux




HIGH: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Product status

Default status
unaffected

f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 (git) before 3543005a42d7e8e12b21897ef6798541bf7cbcd3
affected

f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 (git) before 86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6
affected

f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 (git) before a018d1819f158991b7308e4f74609c6c029b670c
affected

Default status
affected

6.16
affected

Any version before 6.16
unaffected

6.18.22 (semver)
unaffected

6.19.12 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/3543005a42d7e8e12b21897ef6798541bf7cbcd3

git.kernel.org/...c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6

git.kernel.org/...c/a018d1819f158991b7308e4f74609c6c029b670c

cve.org (CVE-2026-31766)

nvd.nist.gov (CVE-2026-31766)

Download JSON