PT-2026-44332 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46209

NVD

In the Linux kernel, the following vulnerability has been resolved:

drm/gem: Fix inconsistent plane dimension calculation in drm gem fb init with funcs()

drm gem fb init with funcs() computes sub-sampled plane dimensions using plain integer division:

unsigned int width = mode cmd->width / (i ? info->hsub : 1); unsigned int height = mode cmd->height / (i ? info->vsub : 1);

However, the ioctl-level framebuffer check() in drm framebuffer.c uses drm format info plane width/height() which round up dimensions via DIV ROUND UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations.

For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT MAX as an unsigned int, causing min size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds.

Fix by replacing the open-coded divisions with drm format info plane width() and drm format info plane height(), which use DIV ROUND UP() and match the calculation already used in framebuffer check().

Related Identifiers

CVE-2026-46209

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46209 · Security Note
• https://git.kernel.org/stable/c/3d4c2268bd7243c3780fe32bf24ff876da272acf · Note
• https://git.kernel.org/stable/c/6b992591e04f2cce813bcf239b354f375bbf84d3 · Note
• https://git.kernel.org/stable/c/c5fc49d8470c5ebf3b41607600f277158f159950 · Note
• https://git.kernel.org/stable/c/1a17ea9861e89585361caa8bc231bd22dc6dbe7d · Note
• https://git.kernel.org/stable/c/1da4ab7189f1064b3b712b388772c008b4d82580 · Note