UBUNTU-CVE-2026-63878: Ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check numentries in GEMOP GETMAPPINGINFO kvcalloc(args->numentries, sizeof(vmentries), GFPKERNEL) at amdgpugem.c:1050 uses the user-supplied numentries directly without any upper bounds check. Since numentries is a u32 and sizeof(drmamdgpugemvmentry) is 32 bytes, a large numentries produces an allocation exceeding INTMAX, triggering WARNING in kvmallocnodenoprof(), causing a kernel WARNING, TAINTWARN, and panic on CONFIGPANICONWARN=y systems. Add a size bounds check before we invoke the kvzalloc() to reject oversized numentries early with -EINVAL. (cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
An attacker needs the ability to issue the AMDGPU GEM_OP GET_MAPPING_INFO operation with a user-controlled num_entries value. The vulnerable allocation uses that value directly.
What is the practical impact on affected systems?
A sufficiently large num_entries can cause an allocation request exceeding INT_MAX, producing a kernel WARNING and TAINT_WARN state. Systems built with CONFIG_PANIC_ON_WARN=y can panic, resulting in a denial of service.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
How does the fix prevent the failure?
The fix validates num_entries before invoking the allocation and rejects oversized values with -EINVAL. This prevents the oversized allocation request from reaching kvzalloc().