CVE-2026-89818

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-89818

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89818.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-89818

Downstream

Related

openSUSE-SU-2026:11880-1

Published

2026-09-16T10:30:50Z

Modified

2026-10-08T02:52:20Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVSS Calculator

Summary

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check.

Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89818.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

88411caee8f576d6b5abf6531232fcc0ce756dc5

Fixed

c2340281be4ddacb8c203e2bce59b126d1d6c4c8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e

Fixed

6dceaeceaa7c8396339f3ea34b0110cb912ca61b

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

7688143ca62edeecacb3ba0a2cea129dbd262a18

Fixed

47799e1f893d47d8af231710a61065e3ec8a13e8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

63b51e8a9d54317d31cc3856c1e12407070d5fc2

Fixed

7e28853c78c20bb8ba4c1dba702430cd05e09f76

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

b193019860d61e92da395eae2011f2f6716b182f

Fixed

9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3

Fixed

4d7390530853eb7befda9cc786e4c86e8ad7ac9e

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.175

Fixed

6.1.188

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.140

Fixed

6.6.157

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.90

Fixed

6.12.110

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.18.32

Fixed

6.18.51

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.209

Fixed

5.16

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

7.0.9

Fixed

7.1

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

f55552adb100eb54a6e6dabff4fbdc8679bd3fa0

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

82c535eff05490c71153af57de9fe85502fcb5d5

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

638d3e0b9eb77aa53fdd60e2b928761d16ba76fa

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

870c8738c3774336baedddd0240951d078a703b8

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

638e48ee39d0f2af9336f917a6f5d6692dd64d93

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

3c817a60b09eaab926e475088e750936efcc95ae

Affected versions

v5.*

v5.15.209

v5.15.210

v5.15.211

v5.15.212

v5.15.213

v5.15.214

v5.15.215

v5.15.216

v5.15.217

v5.15.218

v5.15.219

v5.15.220

v5.15.221

v5.15.222

v6.*

v6.1.175

v6.1.176

v6.1.177

v6.1.178

v6.1.179

v6.1.180

v6.1.181

v6.1.182

v6.1.183

v6.1.184

v6.1.185

v6.1.186

v6.1.187

v6.1.188

v6.1.189

v6.12.100

v6.12.101

v6.12.102

v6.12.103

v6.12.104

v6.12.105

v6.12.106

v6.12.107

v6.12.108

v6.12.109

v6.12.110

v6.12.111

v6.12.112

v6.12.90

v6.12.91

v6.12.92

v6.12.93

v6.12.94

v6.12.95

v6.12.96

v6.12.97

v6.12.98

v6.12.99

v6.18.32

v6.18.33

v6.18.34

v6.18.35

v6.18.36

v6.18.37

v6.18.38

v6.18.39

v6.18.40

v6.18.41

v6.18.42

v6.18.43

v6.18.44

v6.18.45

v6.18.46

v6.18.47

v6.18.48

v6.18.49

v6.18.50

v6.18.51

v6.18.52

v6.18.53

v6.18.54

v6.18.55

v6.6.140

v6.6.141

v6.6.142

v6.6.143

v6.6.144

v6.6.145

v6.6.146

v6.6.147

v6.6.148

v6.6.149

v6.6.150

v6.6.151

v6.6.152

v6.6.153

v6.6.154

v6.6.155

v6.6.156

v6.6.157

v6.6.158

v7.*

v7.0.10

v7.0.11

v7.0.12

v7.0.13

v7.0.14

v7.0.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89818.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.1.188

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.157

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.110

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.51

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.2.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89818.json"