CVE-2026-80576: drm/amdgpu: reject oversized IBs with per-ring packet limits
drm/amdgpu: reject oversized IBs with per-ring packet limits
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.105-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.107-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.105 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.46 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
Linux kernel drm/amdgputo a version that resolves this vulnerability.Patch 7f48fa2cf62e3fa6c9c3870aa74988f773247e52
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel amdgpu driver are exposed when untrusted users can submit GPU command streams that reach amdgpu_cs_p2_ib(). The issue concerns user-supplied instruction-buffer sizes on AMDGPU command-submission rings.
What does an attacker need to do to trigger the vulnerability?
An attacker needs to submit an instruction buffer whose byte size exceeds the packet-length field supported by the target ring. The oversized size is converted to a dword length and encoded into ring packet fields, potentially corrupting adjacent control bits.
Which ring types have an explicit documented limit?
GFX, compute, SDMA, and VPE rings use a documented 20-bit instruction-buffer packet limit. Other ring types use an MM fallback limit.
What mitigation is available if the update cannot be applied immediately?
The provided data does not identify a configuration workaround. Reducing access to AMDGPU command submission by untrusted users may reduce exposure, but this is not specified as a vendor-provided mitigation.