CVE-2026-63878: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO
kvcalloc(args->numentries, sizeof(vmentries), GFPKERNEL) at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and sizeof(drmamdgpugemvmentry) is 32 bytes, a large numentries produces an allocation exceeding INTMAX, triggering WARNING in kvmallocnodenoprof(), causing a kernel WARNING, TAINTWARN, and panic on CONFIGPANICONWARN=y systems.
Add a size bounds check before we invoke the kvzalloc() to reject oversized numentries early with -EINVAL.
(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63878?
CVE-2026-63878 is classified with a risk score of 26.
How do I fix CVE-2026-63878?
To fix CVE-2026-63878, update to the latest patched version of the Linux kernel where the vulnerability has been resolved.
What component is affected by CVE-2026-63878?
CVE-2026-63878 affects the Linux kernel, specifically the amdgpu driver in the DRM subsystem.
What causes CVE-2026-63878?
CVE-2026-63878 is caused by a failure to check the upper bounds of user-supplied num_entries in the GEM_OP GET_MAPPING_INFO operation.
Is CVE-2026-63878 exploitative?
CVE-2026-63878 can potentially allow unauthorized memory access, making it exploitable under certain conditions.