CVE-2026-63878

drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

published July 19, 2026

CVSS
—
EPSS
0%
Percentile
10.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at

amdgpu_gem.c:1050 uses the user-supplied num_entries directly without

any upper bounds check. Since num_entries is a __u32 and

sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries

produces an allocation exceeding INT_MAX, triggering

WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING,

TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems.

Add a size bounds check before we invoke the kvzalloc() to

reject oversized num_entries early with -EINVAL.

(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.2th percentile
Published
2026-07-19T14:54Z
EPSS history
Timeline
  • 19 JUL 14:54Z
    drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
    cvelistv5