CVE-2026-68272

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate CPGFXSHADOW chunk size in CS pass1

Add a minimum-length check for the AMDGPUCHUNKIDCPGFXSHADOW chunk in amdgpucspass1(), matching the gate already present for the IB, FENCE and BOHANDLES chunk types.

The CPGFXSHADOW case previously shared a bare break with the dependency and syncobj chunk types, which do not dereference a fixed-size struct. When userspace submits this chunk with lengthdw == 0, vmemduparrayuser() is called with size 0 and returns ZEROSIZEPTR, which passes the ISERR() check. amdgpucsp2shadow() then dereferences chunk->kdata as a struct drmamdgpucschunkcpgfxshadow (reading shadow->flags), faulting on the ZEROSIZE_PTR and causing a NULL-pointer dereference.

This is reachable by an unprivileged process in the render group. Reject undersized chunks with -EINVAL during pass1 so the bad submission is rejected before pass2 ever dereferences the data.

(cherry picked from commit 7f61b2eef7415eccdb40850aca0de94211948657)