https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:24:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-63878 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO</p> <p>kvcalloc(args-&gt;num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds check. Since num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries produces an allocation exceeding INT_MAX, triggering WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING, TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems.</p> <p>Add a size bounds check before we invoke the kvzalloc() to reject oversized num_entries early with -EINVAL.</p> <p>(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO</p> <p>kvcalloc(args-&gt;num_entries, sizeof(*vm_entries), GFP_KERNEL) at amdgpu_gem.c:1050 uses the user-supplied num_entries directly without any upper bounds check. Since num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries produces an allocation exceeding INT_MAX, triggering WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING, TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems.</p> <p>Add a size bounds check before we invoke the kvzalloc() to reject oversized num_entries early with -EINVAL.</p> <p>(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)</p> https://vulnerability.circl.lu/vuln/cve-2026-63878