CVE-2026-89818
Received
Received - Intake
BaseFortify
Vulnerability report for CVE-2026-89818, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-16
Last updated on: 2026-09-16
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression
6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting
the parser loop far past the end of the message BO. Triggering it
additionally requires a ~4GiB mapping so that msg[1] survives the
earlier "header does not fit in BO" check.
Rewrite the test in division form, which is overflow-free by
construction. Also update the message to reflect that msg is invalid.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 88411caee8f576d6b5abf6531232fcc0ce756dc5 |
| Linux | Linux | c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e |
| Linux | Linux | 7688143ca62edeecacb3ba0a2cea129dbd262a18 |
| Linux | Linux | 63b51e8a9d54317d31cc3856c1e12407070d5fc2 |
| Linux | Linux | b193019860d61e92da395eae2011f2f6716b182f |
| Linux | Linux | b193019860d61e92da395eae2011f2f6716b182f |
| Linux | Linux | f55552adb100eb54a6e6dabff4fbdc8679bd3fa0 |
| Linux | Linux | 82c535eff05490c71153af57de9fe85502fcb5d5 |
| Linux | Linux | 638d3e0b9eb77aa53fdd60e2b928761d16ba76fa |
| Linux | Linux | 870c8738c3774336baedddd0240951d078a703b8 |
| Linux | Linux | 638e48ee39d0f2af9336f917a6f5d6692dd64d93 |
| Linux | Linux | e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7 |
| Linux | Linux | 3c817a60b09eaab926e475088e750936efcc95ae |
| Linux | Linux | 6.1.175 |
| Linux | Linux | 6.6.140 |
| Linux | Linux | 6.12.90 |
| Linux | Linux | 6.18.32 |
| Linux | Linux | 5.15.209 |
| Linux | Linux | 7.0.9 |
| Linux | Linux | 7.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
