CVE-2026-80576
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
26/08/2026
Última modificación:
27/08/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/amdgpu: reject oversized IBs with per-ring packet limits<br />
<br />
On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through<br />
to ib->length_dw without a limit, while ring_emit_ib() encodes length<br />
into packet fields. Oversized values can corrupt adjacent control bits<br />
and destabilize command submission.<br />
<br />
Add a per-ring IB packet size limit helper and reject command<br />
submissions exceeding the corresponding dword limit before IB<br />
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,<br />
and apply the MM fallback limit for other ring types.<br />
<br />
(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Impacto
Puntuación base 3.x
8.80
Gravedad 3.x
ALTA