UBUNTU-CVE-2026-89818: Integer Overflow
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in decmsg buffer count check If the supplied msg[2] (numbuffers) is 0x3FFFFFFF, the expression 6 + numbuffers 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Rewrite the dec_msg buffer-count bounds check in division form so it is overflow-free by construction, and treat the message as invalid when the check fails; specifically protect the check involving msg[2] (num_buffers) from overflow in the expression 6 + num_buffers * 4.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running an affected Ubuntu Linux kernel variant with the AMDGPU VCN driver in use are exposed. Exploitation requires a local attacker with low privileges.
What does an attacker need to trigger the flaw?
The attacker must supply a crafted message with num_buffers set to 0x3FFFFFFF and must also have access to an approximately 4 GiB mapping so the message header passes the earlier buffer-object size check.
What is the impact if exploitation succeeds?
The integer overflow can make the buffer-count bounds check pass incorrectly, allowing the parser to iterate far beyond the end of the message buffer object. The supplied vector rates availability impact as high, with no confidentiality or integrity impact indicated.
Is user interaction or remote network access required?
No. The vector identifies the attack as local, requiring low privileges, with no user interaction required.