CVE-2026-80576
Received Received - Intake

AMDGPU Command Submission Buffer Overflow

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through to ib->length_dw without a limit, while ring_emit_ib() encodes length into packet fields. Oversized values can corrupt adjacent control bits and destabilize command submission. Add a per-ring IB packet size limit helper and reject command submissions exceeding the corresponding dword limit before IB allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE, and apply the MM fallback limit for other ring types. (cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80576
EUVD
EUVD-2026-66491

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the AMD GPU driver where oversized command submissions can corrupt adjacent control bits and destabilize command submission. The issue occurs because the amdgpu_cs_p2_ib function does not enforce a limit on user-supplied ib_bytes before converting it to ib->length_dw, allowing potential system instability.

Detection Guidance

This vulnerability affects the Linux kernel's AMD GPU driver. Detection requires checking kernel logs for GPU-related errors or crashes, particularly involving command submission. Monitor for messages like 'oversized IB' or 'IB allocation failure' in dmesg or journalctl logs. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker with local access to cause system instability or crashes by submitting oversized command buffers to the GPU. This may lead to denial-of-service conditions or potential privilege escalation if exploited.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-80576. If immediate patching is not possible, restrict access to GPU functionality or disable AMD GPU usage until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart