CVE-2026-43398

Analyzed Analyzed - Analysis Complete

Memory Corruption in AMDGPU Linux Kernel Driver

Publication date: 2026-05-08

Last updated on: 2026-05-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add upper bound check on user inputs in wait ioctl Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and could be exploited. So check these input value against AMDGPU_USERQ_MAX_HANDLES which is big enough value for genuine use cases and could potentially avoid OOM. v2: squash in Srini's fix (cherry picked from commit fcec012c664247531aed3e662f4280ff804d1476)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-21

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-43398

EUVD

EUVD-2026-28704

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.0
linux	linux_kernel	From 6.19 (inc) to 6.19.9 (exc)
linux	linux_kernel	From 6.16 (inc) to 6.18.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's amdgpu driver, specifically in the drm/amdgpu component. It involves the wait ioctl function where user inputs are not properly bounded. Large input values passed to the amdgpu_userq_wait_ioctl function can cause an out-of-memory (OOM) condition.

The issue was fixed by adding an upper bound check on user inputs against a defined maximum value (AMDGPU_USERQ_MAX_HANDLES), which is sufficiently large for legitimate use cases but prevents excessive values that could lead to OOM.

Impact Analysis

If exploited, this vulnerability can cause the system to run out of memory (OOM) due to processing huge input values in the amdgpu_userq_wait_ioctl function. This could lead to system instability, crashes, or denial of service conditions.

Mitigation Strategies

To mitigate this vulnerability, ensure that the Linux kernel version you are using includes the fix that adds an upper bound check on user inputs in the amdgpu wait ioctl.

Specifically, the fix checks input values against AMDGPU_USERQ_MAX_HANDLES to prevent huge input values that could lead to an out-of-memory (OOM) condition.

Therefore, updating your kernel to a version that contains the commit fcec012c664247531aed3e662f4280ff804d1476 or later will mitigate this issue.

Hi! I’m here to help you understand CVE-2026-43398. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70