CVE-2026-46218
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add bounds checking to ib_{get,set}_value The uvd/vce/vcn code accesses the IB at predefined offsets without checking that the IB is large enough.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.13%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add bounds checking to ib_{get,set}_value The uvd/vce/vcn code accesses the IB at predefined offsets without checking that the IB is large enough. Check the bounds here. The caller is responsible for making sure it can handle arbitrary return values. Also make the idx a uint32_t to prevent overflows causing the condition to fail.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- EPSS
- 0.13% probability · 3th percentile
- CISA KEV
- Not listed
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53fPatch
- https://git.kernel.org/stable/c/5da6c6430be0acb25b4242bce0323fc514d4e3cfPatch
- https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9ePatch
- https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7dPatch
- https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7Patch
- https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.