PT-2026-61195 · Linux · Linux
CVE-2026-63878
·
Published
2026-07-19
·
Updated
2026-07-19
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: check num entries in GEM OP GET MAPPING INFO
kvcalloc(args->num entries, sizeof(*vm entries), GFP KERNEL) at
amdgpu gem.c:1050 uses the user-supplied num entries directly without
any upper bounds check. Since num entries is a u32 and
sizeof(drm amdgpu gem vm entry) is 32 bytes, a large num entries
produces an allocation exceeding INT MAX, triggering
WARNING in kvmalloc node noprof(), causing a kernel WARNING,
TAINT WARN, and panic on CONFIG PANIC ON WARN=y systems.
Add a size bounds check before we invoke the kvzalloc() to
reject oversized num entries early with -EINVAL.
(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux