CVE-2026-89818: Linux Kernel AMDGPU VCN Buffer Overflow

CVE-2026-89818 Overview

CVE-2026-89818 is an integer overflow vulnerability in the Linux kernel's AMD GPU Video Core Next (VCN) decoder message parser. The flaw resides in the dec_msg buffer count check within the drm/amdgpu/vcn driver. When user-supplied msg[2] (num_buffers) equals 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps around to 2, allowing the bounds check to pass. The parser then loops far past the end of the message buffer object (BO). Triggering the flaw additionally requires a ~4GiB mapping so msg[1] survives the earlier header size check.

Critical Impact
A local, low-privileged user with access to the AMD GPU device can trigger an out-of-bounds parser loop, leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel drm/amdgpu/vcn driver (AMD GPU Video Core Next decoder)
Linux stable branches prior to the fix commits referenced in kernel.org
Systems exposing AMD GPU render nodes to unprivileged users

Discovery Timeline

2026-09-16 - CVE-2026-89818 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89818

Vulnerability Analysis

The vulnerability affects the decoder message (dec_msg) parsing path in the amdgpu VCN driver. The parser validates that the declared buffer count fits within the message buffer object using the arithmetic expression 6 + num_buffers * 4. This multiplication is performed on a 32-bit unsigned integer without prior sanity limits on num_buffers.

Submitting num_buffers = 0x3FFFFFFF causes num_buffers * 4 = 0xFFFFFFFC, and adding 6 wraps the result to 2. The bounds check compares the wrapped value against the buffer size and passes trivially. The subsequent parser loop then iterates using the untrusted, attacker-controlled num_buffers value, reading well past the end of the mapped message BO.

Root Cause

The root cause is an unchecked multiplication in a size computation, an [Integer Overflow] weakness. The additive form 6 + num_buffers * 4 is not overflow-safe when num_buffers is attacker-controlled. The upstream fix rewrites the check in division form, which is overflow-free by construction, and clarifies the log message when msg is invalid.

Attack Vector

Exploitation requires local access with permission to submit command buffers to the amdgpu device, typically via /dev/dri/renderD*. The attacker must also arrange a ~4GiB mapping so that msg[1] passes the earlier "header does not fit in BO" check. Once both conditions are met, the crafted num_buffers value causes the VCN decoder parser to read beyond the allocated buffer object, resulting in kernel-space out-of-bounds access and probable system crash or memory disclosure.

The vulnerability is described in prose only; see the upstream fixes at Kernel Git Commit 47799e1 and Kernel Git Commit c234028 for the corrected arithmetic.

Detection Methods for CVE-2026-89818

Indicators of Compromise

Unexpected kernel oops or panic messages referencing amdgpu_vcn_dec_parse or related VCN decoder symbols.
Kernel log entries reporting invalid msg from the VCN decoder path after the patch is applied.
Processes with GPU render node access allocating unusually large (~4GiB) buffer mappings prior to submitting decoder commands.

Detection Strategies

Monitor dmesg and journalctl -k for warnings and stack traces originating in drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c.
Audit which local users and containers have access to /dev/dri/render* nodes; unexpected access from low-trust workloads warrants investigation.
Correlate GPU driver crashes with user session activity to identify potentially malicious command buffer submissions.

Monitoring Recommendations

Enable kernel crash collection (kdump) on GPU-equipped hosts to preserve evidence of exploitation attempts.
Track kernel package versions across the fleet and flag hosts running unpatched Linux kernels with the amdgpu driver loaded.
Alert on repeated segmentation faults or GPU resets tied to a single process or container.

How to Mitigate CVE-2026-89818

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced by the fix commits on kernel.org as soon as distribution updates are available.
Restrict access to /dev/dri/render* nodes to trusted users and groups only, particularly on multi-tenant hosts.
Inventory systems using the amdgpu VCN decoder and prioritize patching workstations and shared build/render servers.

Patch Information

The fix rewrites the buffer count check in division form to eliminate the integer overflow. Backports are available across multiple stable branches: Kernel Git Commit 47799e1, Kernel Git Commit 4d73905, Kernel Git Commit 6dceaec, Kernel Git Commit 7e28853, Kernel Git Commit 9ae19bd, and Kernel Git Commit c234028.

Workarounds

Unload the amdgpu module on systems that do not require hardware video decoding: modprobe -r amdgpu (only where feasible).
Deny non-root users membership in the video and render groups on servers that do not run trusted GPU workloads.
Use mandatory access control policies (SELinux, AppArmor) to restrict which processes may open DRI render nodes.

bash

# Configuration example: restrict render node access to a trusted group
sudo groupadd gpu-trusted
sudo chown root:gpu-trusted /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128

# Verify installed kernel includes the fix
uname -r
dmesg | grep -i "amdgpu.*vcn"