Bug 2502393 (CVE-2026-63878)

Summary:	CVE-2026-63878 kernel: drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `drm/amdgpu` component of the Linux kernel. A local attacker can exploit an integer overflow vulnerability by providing an excessively large value for the `num_entries` parameter in the `GEM_OP GET_MAPPING_INFO` ioctl. This can lead to an attempt to allocate an extremely large amount of memory, resulting in a kernel warning, system taint, and potentially a system panic, causing a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-19 16:05:46 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO

kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) at
amdgpu_gem.c:1050 uses the user-supplied num_entries directly without
any upper bounds check. Since num_entries is a __u32 and
sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a large num_entries
produces an allocation exceeding INT_MAX, triggering
WARNING in __kvmalloc_node_noprof(), causing a kernel WARNING,
TAINT_WARN, and panic on CONFIG_PANIC_ON_WARN=y systems.

Add a size bounds check before we invoke the kvzalloc() to
reject oversized num_entries early with -EINVAL.

(cherry picked from commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d)

Comment 1 Keith Grant 2026-07-21 19:48:35 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026071938-CVE-2026-63878-d23a@gregkh/T