CVE-2026-31766

Published: May 1, 2026

Modified: May 11, 2026

PUBLISHED

CVSS v3.1

7.1

HIGH

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. (cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)

Vendor	Product	Versions
Linux	Linux	affected `f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 - < 3543005a42d7e8e12b21897ef6798541bf7cbcd3` affected `f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 - < 86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6` affected `f09c1e6077abd1bc2ddd2b97e1135215801ca7f9 - < a018d1819f158991b7308e4f74609c6c029b670c`
Linux	Linux	affected `6.16` unaffected `0 - < 6.16` unaffected `6.18.22 - <= 6.18.` unaffected `6.19.12 - <= 6.19.` unaffected `7.0 - <= *`

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

References

https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3

https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6

https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2026-31766

Description

Affected Products

CVSS v3.1 Details

References