CVE-2026-46199: Linux Kernel AMDGPU VCN4 OOB Vulnerability

CVE-2026-46199 Overview

CVE-2026-46199 is an out-of-bounds read vulnerability in the Linux kernel's AMD GPU driver. The flaw resides in the drm/amdgpu/vcn4 component, which handles Video Core Next (VCN) generation 4 hardware decoding. The driver fails to validate bounds against the end of the buffer object (BO) when parsing decoder messages. A local attacker submitting crafted decoder messages can trigger reads beyond the allocated BO, exposing kernel memory contents or causing instability. The issue has been resolved upstream through multiple stable kernel commits.

Critical Impact
Out-of-bounds reads in the kernel-mode amdgpu driver can leak kernel memory and induce undefined behavior on systems with AMD GPUs supporting VCN4 hardware decoding.

Affected Products

Linux kernel versions containing the drm/amdgpu/vcn4 decoder message parsing code prior to the fix
Systems with AMD GPUs that expose VCN generation 4 hardware decode acceleration
Linux distributions shipping stable kernels that have not backported the referenced commits

Discovery Timeline

2026-05-28 - CVE-2026-46199 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46199

Vulnerability Analysis

The vulnerability is classified as an Out-of-Bounds Read in the amdgpu Direct Rendering Manager (DRM) driver. The VCN4 decoder uses a buffer object (BO) to receive command messages from userspace describing decode operations. The kernel's message parser accesses fields within this BO to determine the type and parameters of the decode request. Without consistent bounds checking against the end of the BO, the parser can dereference offsets that fall outside the allocated mapping. The committed fix introduces explicit bounds validation at each access point in the message parser.

Root Cause

The root cause is missing validation that each msg field access remains within the BO's mapped extent. The parser previously trusted offsets derived from the message header without re-checking them against the BO size. When the message structure declares a length or pointer extending beyond the actual buffer, the kernel reads adjacent memory.

Attack Vector

Exploitation requires local access to a user account with permission to submit command buffers to the amdgpu driver through DRM ioctls. The attacker constructs a decoder message in a graphics buffer whose declared sizes or offsets exceed the BO allocation. When the kernel parses this message during command submission, it reads beyond the BO. The vulnerability primarily affects information disclosure but may also be chained with other flaws.

No verified exploit code is publicly available. Refer to the upstream patches for technical details of the affected parsing routine: Kernel commit 3c817a60b09e and Kernel commit 63b51e8a9d54.

Detection Methods for CVE-2026-46199

Indicators of Compromise

Unexpected amdgpu driver warnings or KASAN: out-of-bounds in amdgpu_vcn_dec_msg reports in dmesg
Repeated DRM command submission failures from non-graphical processes
Anomalous GPU command buffer submissions from low-privilege user sessions

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test or canary environments to surface out-of-bounds reads in the VCN4 decoder path
Audit kernel logs for amdgpu faults referencing vcn or dec_msg parsing functions
Inventory hosts running AMD GPUs with VCN4 hardware and confirm their kernel version against the patched commits

Monitoring Recommendations

Forward kernel ring buffer events to a centralized logging pipeline for cross-host correlation
Track unusual users invoking DRM ioctls on workstations and shared compute hosts
Monitor unpatched Linux endpoints with AMD GPUs as elevated-risk assets until the kernel update is applied

How to Mitigate CVE-2026-46199

Immediate Actions Required

Update the Linux kernel to a stable release containing the referenced upstream commits for drm/amdgpu/vcn4
Restrict local access on multi-user systems with AMD VCN4-capable GPUs until patching is complete
Validate that distribution-provided kernel packages include the backport before deploying broadly

Patch Information

The fix is delivered through upstream stable kernel commits, including 0a78f2bac142, 3c817a60b09e, 63b51e8a9d54, 7688143ca62e, and c72a8b4dc6d5. Each patch adds bounds checks against the end of the BO whenever the decoder message is accessed.

Workarounds

Disable hardware-accelerated video decoding through amdgpu on affected hosts where the workload does not require it
Limit DRM device access to trusted users by tightening permissions on /dev/dri/render* nodes
Avoid running untrusted code on systems with VCN4-capable AMD GPUs until the kernel is patched

bash

# Verify running kernel version and check for the amdgpu vcn module
uname -r
lsmod | grep -E 'amdgpu|vcn'

# Restrict render node access to a dedicated group
sudo chgrp render /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128