CVE-2026-31766
- Source
- https://cve.org/CVERecord?id=CVE-2026-31766
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31766.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-31766
- Downstream
- Published
- 2026-05-01T14:14:56.622Z
- Modified
- 2026-07-08T08:00:04.856392718Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- drm/amdgpu: validate doorbell_offset in user queue creation
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate doorbell_offset in user queue creation
amdgpuuserqgetdoorbellindex() passes the user-provided doorbelloffset to amdgpudoorbellindexonbar() without bounds checking. An arbitrarily large doorbelloffset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space.
Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow.
(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31766.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3
- https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6
- https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31766.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-31766
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git