CVE-2026-89818: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check
If the supplied msg[2] (numbuffers) is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check.
Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds parser loop?
An attacker must supply a message whose msg[2] num_buffers value is 0x3FFFFFFF and must also have a roughly 4 GiB mapping. The large mapping is needed for msg[1] to pass the earlier header-size check.
Why does the original bounds check fail?
With num_buffers set to 0x3FFFFFFF, calculating 6 + num_buffers * 4 overflows and wraps to 2. The resulting small value passes the bounds check, after which the parser can iterate beyond the message buffer object.
What is the corrective change?
The fixed code performs the validation using division rather than multiplying the buffer count. This avoids the integer overflow that allowed the malformed count to bypass the check.