CVE-2026-63878: Linux Kernel AMDGPU DOS Vulnerability

CVE-2026-63878 Overview

CVE-2026-63878 is a Linux kernel vulnerability in the AMD GPU (amdgpu) Direct Rendering Manager (DRM) driver. The flaw resides in the GEM_OP GET_MAPPING_INFO ioctl handler at amdgpu_gem.c:1050, where kvcalloc() is called with a user-supplied num_entries value without any upper bounds validation. A local user can pass a large __u32 value that produces an allocation exceeding INT_MAX, triggering a WARNING in __kvmalloc_node_noprof(), marking the kernel as TAINT_WARN, and causing a kernel panic on systems built with CONFIG_PANIC_ON_WARN=y.

Critical Impact
Local unprivileged users with access to the amdgpu DRM device can trigger a kernel WARNING and force a panic on hardened kernels using CONFIG_PANIC_ON_WARN=y, resulting in denial of service.

Affected Products

Linux kernel versions containing the drm/amdgpuGEM_OP GET_MAPPING_INFO handler prior to the fix
Distributions shipping the vulnerable amdgpu DRM driver with AMD GPU hardware
Systems configured with CONFIG_PANIC_ON_WARN=y (elevated impact)

Discovery Timeline

2026-07-19 - CVE-2026-63878 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63878

Vulnerability Analysis

The vulnerability is a missing input validation issue [CWE-1284] in the AMD GPU DRM driver. The GEM_OP GET_MAPPING_INFO ioctl accepts a num_entries field from userspace and passes it directly to kvcalloc(args->num_entries, sizeof(*vm_entries), GFP_KERNEL) without checking whether the resulting allocation size is reasonable.

Because num_entries is a __u32 and sizeof(drm_amdgpu_gem_vm_entry) is 32 bytes, a caller can request a multiplication result that exceeds INT_MAX. The kernel's __kvmalloc_node_noprof() allocator emits a WARN when allocation size crosses this threshold. The resulting warning taints the kernel and, on CONFIG_PANIC_ON_WARN=y builds, forces an immediate panic, producing a denial-of-service condition.

Root Cause

The root cause is unbounded arithmetic on attacker-controlled input prior to a large allocation. The handler trusts the userspace-supplied num_entries value and forwards it to kvcalloc() without capping it against a driver-defined maximum. The upstream fix adds a size bounds check before invoking kvzalloc() and rejects oversized num_entries early with -EINVAL.

Attack Vector

Exploitation requires local access and the ability to open the amdgpu DRM character device (typically /dev/dri/card* or /dev/dri/renderD*). An attacker issues the DRM_IOCTL_AMDGPU_GEM_OP ioctl with op = AMDGPU_GEM_OP_GET_MAPPING_INFO and a crafted large num_entries value. The kernel then attempts an allocation larger than INT_MAX, triggering the WARN and, on hardened kernels, a panic. No elevated privileges are required beyond DRM device access, which is commonly granted to logged-in desktop users through the video or render groups.

No verified public exploit code is available. See the upstream patches referenced below for the exact code paths and the fix.

Detection Methods for CVE-2026-63878

Indicators of Compromise

Kernel log entries containing WARNING: at mm/util.c or __kvmalloc_node_noprof immediately following an amdgpu ioctl call
TAINT_WARN flag set in /proc/sys/kernel/tainted after graphics-related activity from an unprivileged process
Unexpected kernel panics on systems running CONFIG_PANIC_ON_WARN=y with AMD GPU hardware, correlated with a specific user session

Detection Strategies

Monitor dmesg and journal output for WARN traces referencing amdgpu_gem.c or amdgpu_gem_op_ioctl
Correlate DRM ioctl activity from non-graphical processes with subsequent kernel warnings using audit rules on /dev/dri/*
Track abnormal process termination followed by kernel taint state changes across the fleet

Monitoring Recommendations

Ingest kernel ring buffer and journald events into a centralized log platform and alert on amdgpu WARN signatures
Baseline which users and services legitimately open /dev/dri/renderD* and flag deviations
On CONFIG_PANIC_ON_WARN=y fleets, treat any AMD GPU driver panic as a high-priority investigation event

How to Mitigate CVE-2026-63878

Immediate Actions Required

Apply the upstream kernel patches once they land in your distribution's stable branch
Inventory systems using AMD GPU hardware and identify hosts running CONFIG_PANIC_ON_WARN=y, which face the highest availability impact
Restrict access to /dev/dri/* devices on servers where interactive GPU access is not required

Patch Information

The fix adds a size bounds check before the kvzalloc() call and returns -EINVAL for oversized num_entries. It was cherry-picked from upstream commit 1fe7bf5457f6efd7be60b17e23163ba54341d73d. Stable tree patches are available at Kernel Patch 967a00b8, Kernel Patch a1ba4594, and Kernel Patch f059b4c4.

Workarounds

Remove untrusted users from the video and render groups to limit access to /dev/dri/* devices
Consider disabling CONFIG_PANIC_ON_WARN=y on non-security-critical systems until patches are deployed, accepting the tradeoff of continued operation after a WARN
Unload the amdgpu module on hosts that do not require GPU acceleration with modprobe -r amdgpu

bash

# Verify running kernel version and check for AMD GPU driver
uname -r
lsmod | grep amdgpu

# Restrict DRM device access to trusted groups only
ls -l /dev/dri/
sudo gpasswd -d <untrusted_user> render
sudo gpasswd -d <untrusted_user> video

# Check kernel taint state after suspected exploitation attempts
cat /proc/sys/kernel/tainted