CVE-2026-31766
HighSummary
A vulnerability has been identified in the Linux kernel regarding the validation of the doorbell_offset parameter during user queue creation in amdgpu. Lack of proper bounds checking may lead to corruption of the doorbell space in the kernel.
Risk Assessment
Potential corruption of the doorbell space in the kernel could lead to system instability and allow attackers to execute unauthorized code in the kernel context.
Recommendation
It is recommended to update the Linux kernel to the latest version that includes fixes for this vulnerability and to implement appropriate parameter validation mechanisms in applications using amdgpu.
Other vulnerabilities in Linux kernel (amdgpu)
See all- CVE-2026-43318Medium
A vulnerability related to sync handling in amdgpu has been resolved in the Linux kernel. Invalidating a dmabuf can impact other users of the shared buffer object (BO).
- CVE-2026-45979Medium
A vulnerability in the Linux kernel related to amdgpu has been resolved, which occurred under low memory conditions. In such situations, the kmalloc function could fail, requiring the mutex to be unlocked for a clean exit.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. (cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)