CVE-2026-68107
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, the amdgpu driver (VCN4) avoids rereading the IB parameter length. Instead, it uses the value returned by vcn_v4_0_enc_find_ib_param(), eliminating a potential TOCTOU issue if the IB contents change between reads.
Risk Assessment
TOCTOU issue may lead to incorrect encoder behavior, potentially allowing an attacker to manipulate data or cause a crash.
Recommendation
Apply the Linux kernel update containing this commit to eliminate TOCTOU-related risk.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)