CVE-2026-46204: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.140 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.90 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.32 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.90-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.0.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Rewrite the drm/amdgpu VCN4 IB parsing to use amdgpu_ib_get_value(), which performs bounds checks and prevents out-of-bounds reads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46204?
The severity of CVE-2026-46204 is rated as high with a CVSS score of 7.1.
How do I fix CVE-2026-46204?
To fix CVE-2026-46204, ensure that your Linux kernel is updated to the latest version that includes the relevant patches for the amdgpu vcn4.
What type of vulnerability is CVE-2026-46204?
CVE-2026-46204 is an out-of-bounds read vulnerability in the Linux kernel related to the amdgpu graphics driver.
What impact does CVE-2026-46204 have on systems?
CVE-2026-46204 can potentially allow an attacker to read sensitive memory, leading to information disclosure.
Are there any exploit scenarios for CVE-2026-46204?
Exploitation of CVE-2026-46204 could occur in scenarios where unprivileged users can interact with the amdgpu driver, particularly in systems running vulnerable kernel versions.