CVE-2026-64516 (GCVE-0-2026-64516)
Vulnerability from cvelistv5
Published
2026-07-25 09:14
Modified
2026-08-05 12:42
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access. Make sure the stack and data offsets are aligned to the 32K TLB size. Check that the FW microcode actually fits in the space that is reserved for it. (cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)
References
Impacted products
Vendor Product Version
Linux Linux Version: d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f
Version: d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4",
              "status": "affected",
              "version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
              "versionType": "git"
            },
            {
              "lessThan": "3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3",
              "status": "affected",
              "version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n\nThe VCPU BO contains the actual FW at an offset, but\nit was not calculated into the VCPU BO size.\nSubtract this from the FW size to make sure there is\nno out of bounds access.\n\nMake sure the stack and data offsets are aligned to\nthe 32K TLB size.\n\nCheck that the FW microcode actually fits in the\nspace that is reserved for it.\n\n(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches VCE1 through DRM command-submission ioctls on the local render device; there is no network or physical attack path.\nAC:L - An attacker can repeatedly submit VCE jobs and control session allocation and engine power-up without winning an uncontrollable race or relying on an unusual runtime condition.\nPR:L - The AMDGPU_CS ioctl is DRM_RENDER_ALLOW and contains no capability or DRM-master requirement, so ordinary users with render-node access can reach it.\nUI:N - Exploitation requires only attacker-controlled ioctl submissions and does not depend on another user opening content or performing an action.\nS:C - The VCE VCPU operates through direct GPU/GART addresses with its VM control disabled, so access beyond the kernel VCPU BO crosses the GPU DMA memory-isolation boundary.\nC:H - The oversized and misaligned read/write cache windows can expose adjacent VRAM or GART-backed memory outside the VCPU BO, potentially permitting disclosure of high-value memory.\nI:H - The VCE data and stack windows are writable, so their out-of-bounds placement can corrupt adjacent GPU or GART-backed allocations and potentially affect execution or protected data.\nA:H - The invalid firmware layout can cause VCE VM faults, firmware failure, or a GPU/card lockup, and an unprivileged attacker can repeatedly reactivate the engine to reproduce the disruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:33.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3"
        }
      ],
      "title": "drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64516",
    "datePublished": "2026-07-25T09:14:43.142Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-08-05T12:42:33.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.