CVE-2026-89818: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Rewrite the drm/amdgpu/vcn dec_msg buffer-count bounds check in division form so it is overflow-free by construction, and update the message to indicate that msg is invalid when the check fails.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds parser loop?
An attacker must supply a message whose msg[2] num_buffers value is 0x3FFFFFFF and must also have a roughly 4 GiB mapping. The large mapping is needed for msg[1] to pass the earlier header-size check.
Why does the original bounds check fail?
With num_buffers set to 0x3FFFFFFF, calculating 6 + num_buffers * 4 overflows and wraps to 2. The resulting small value passes the bounds check, after which the parser can iterate beyond the message buffer object.
What is the corrective change?
The fixed code performs the validation using division rather than multiplying the buffer count. This avoids the integer overflow that allowed the malformed count to bypass the check.