CVE-2026-68108

drm/amdgpu/vce: fix integer overflow in image size

HIGH
8.8
CVSS Score
Published: August 10, 2026 at 11:58 AM UTC
Updated: October 19, 2026 at 09:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware. V2: remove redundant check V3: modify max height value V4: remove size64 (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

4.2f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c
Vendor states this is fixed in 00c311a13d225266800c712f2b7db2711c6897de (fixed)
Vendor states this is fixed in 186bfdc4e26d019b2e7570cb121964a1d89b2e5b (fixed)
Vendor states this is fixed in 7eebef042c12dfe0568593ee6a8926d16505925e (fixed)
Vendor states this is fixed in 893db20383800cfe92e638705984eebb13bc81a5 (fixed)
Vendor states this is fixed in a07430abd556de3707adfcadcc60db3fa64e4b2b (fixed)
Vendor states this is fixed in a6d7065b91a14790980ce6f4960db0ca8c3c9940 (fixed)
Vendor states this is fixed in 4.2 (unaffected)
Vendor states this is fixed in 6.1.183 (unaffected)
Vendor states this is fixed in 6.12.101 (unaffected)
Vendor states this is fixed in 6.18.42 (unaffected)
Vendor states this is fixed in 6.6.148 (unaffected)
Vendor states this is fixed in 7.1.6 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED
CWE
CWE-190

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card