In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: reject oversized IBs with per-ring packet limits

On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
to ib->length_dw without a limit, while ring_emit_ib() encodes length
into packet fields. Oversized values can corrupt adjacent control bits
and destabilize command submission.

Add a per-ring IB packet size limit helper and reject command
submissions exceeding the corresponding dword limit before IB
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,
and apply the MM fallback limit for other ring types.

(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 1474f3970d1afd303e12ff14d06808eabb371576
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 07fe270ec07c138a70afe7a81e115a85c35c545c
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27
0 affected < 6.12.105
0 affected < 6.18.46
0 affected < 7.1.10
Linux Linux affected
Version Status Constraints
6.12.105 unaffected ≤ 6.12.*
6.18.46 unaffected ≤ 6.18.*
7.1.10 unaffected ≤ 7.1.*
7.2 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c cve-icon cve-icon
https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576 cve-icon cve-icon
https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8 cve-icon cve-icon
https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27 cve-icon cve-icon
History

Wed, 26 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
CWE-682

Wed, 26 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)
Title drm/amdgpu: reject oversized IBs with per-ring packet limits
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T14:37:35.538Z

Reserved: 2026-08-26T14:34:25.768Z

Link: CVE-2026-80576

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T15:17:13.653

Modified: 2026-08-26T15:17:13.653

Link: CVE-2026-80576

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T16:00:07Z

Weaknesses