CVE-2026-31766: drm/amdgpu: validate doorbell_offset in user queue creation
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate doorbelloffset in user queue creation
amdgpuuserqgetdoorbellindex() passes the user-provided doorbelloffset to amdgpudoorbellindexonbar() without bounds checking. An arbitrarily large doorbelloffset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space.
Validate that doorbelloffset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow.
(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure doorbell_offset used for user queue creation is validated to fall within the doorbell BO (doorbell buffer object) before amdgpu_userq_get_doorbell_index() computes the doorbell index.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31766?
CVE-2026-31766 has been classified with a severity rating that indicates potential risks associated with the doorbell_offset validation in user queue creation.
How do I fix CVE-2026-31766?
To fix CVE-2026-31766, ensure you apply the latest patches provided by the Linux kernel to address the doorbell_offset validation issue.
Which software is affected by CVE-2026-31766?
CVE-2026-31766 affects the Linux kernel specifically related to the drm/amdgpu components.
What is the impact of CVE-2026-31766?
The impact of CVE-2026-31766 could allow unauthorized access or manipulation of doorbell_offset parameters affecting system stability.
Is there a workaround for CVE-2026-31766?
Currently, implementing the recommended kernel patches is the most effective way to mitigate CVE-2026-31766, as no official workaround is specified.