CVE-2026-46209
Integer Division Flaw in Linux Kernel DRM GEM Plane Calculation
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the function drm_gem_fb_init_with_funcs(). The function calculates sub-sampled plane dimensions using plain integer division, which is inconsistent with another part of the code (framebuffer_check()) that uses a rounding-up method (DIV_ROUND_UP()).
Because of this inconsistency, the size check for certain pixel formats and framebuffer dimensions can be corrupted. For example, with the NV12 pixel format and a 1-pixel-tall framebuffer, the height calculation results in zero instead of one. This causes an unsigned integer underflow and an overflow in the minimum size calculation, allowing a very small GEM object to pass the size validation.
As a result, when the GPU accesses the chroma plane, it may read or write memory beyond the allocated object's bounds, potentially leading to memory corruption.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access by the GPU when handling certain framebuffer formats and dimensions. Such memory corruption can cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or escalate privileges by exploiting the corrupted memory.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability in the Linux kernel's DRM subsystem is caused by inconsistent plane dimension calculations leading to potential memory corruption.
To mitigate this vulnerability, you should update your Linux kernel to a version where the drm_gem_fb_init_with_funcs() function has been fixed to use drm_format_info_plane_width() and drm_format_info_plane_height() with DIV_ROUND_UP() for consistent dimension calculations.
Applying the latest kernel patches or upgrading to a kernel version released after 2026-05-28, when this fix was published, is the recommended immediate step.