CVE-2026-80541
Received Received - Intake

AMDGPU GEM_CREATE Domain Validation Flaw

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80541
EUVD
EUVD-2026-66456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
amd amdgpu *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of GEM_CREATE domain combinations in the AMDGPU driver. The issue occurs when userspace combines CPU, GTT, or VRAM domains with DOORBELL, GDS, GWS, or OA domains. This causes the amdgpu_bo_placement_from_domain() function to exceed its maximum allowed placements and trigger a BUG_ON() error.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMDGPU driver and requires kernel-level inspection. Detection involves checking kernel logs for BUG_ON() crashes related to amdgpu_bo_placement_from_domain() or examining driver code for invalid domain combinations. No network-specific detection commands are applicable.

Impact Analysis

This vulnerability could lead to system crashes or instability if an attacker exploits it to trigger a kernel bug. It primarily affects systems using AMD GPUs with the amdgpu driver, potentially causing denial-of-service conditions.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this AMDGPU driver vulnerability. Monitor kernel logs for related crashes and ensure your system is running a kernel version released after 2026-08-26.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80541. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart