CVE-2026-80541: drm/amdgpu: validate GEM_CREATE domain combinations
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate GEMCREATE domain combinations
AMDGPUGEMCREATE checked domain bits against AMDGPUGEMDOMAINMASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpuboplacementfromdomain() exceed AMDGPUBOMAXPLACEMENTS and hit BUGON().
Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpugemcreateioctl().
v2: Rename helper from amdgpugemdomainvalid() to amdgpugemaredomainsvalid() (Christian)
(cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger the failure?
An attacker needs the ability to issue the AMDGPU_GEM_CREATE ioctl through the amdgpu driver. The issue is triggered by supplying invalid combinations of GEM memory-domain flags.
What is the impact of a successful trigger?
Invalid combinations can cause amdgpu_bo_placement_from_domain() to exceed AMDGPU_BO_MAX_PLACEMENTS and reach a BUG_ON(). This can crash the kernel.
Which domain combinations are invalid?
CPU, GTT, and VRAM may be combined with each other. DOORBELL, GDS, GWS, and OA must each be specified individually and cannot be combined with CPU, GTT, VRAM, or one another.
How does the fix handle malicious or malformed requests?
The corrected amdgpu_gem_create_ioctl() validates domain combinations before processing them. Invalid combinations are rejected with -EINVAL rather than reaching the placement-array limit.