Vulnerability-Lookup

GHSA-Q3HQ-VWMG-M826

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets

The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access.

Make sure the stack and data offsets are aligned to the 32K TLB size.

Check that the FW microcode actually fits in the space that is reserved for it.

(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64516"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:37Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n\nThe VCPU BO contains the actual FW at an offset, but\nit was not calculated into the VCPU BO size.\nSubtract this from the FW size to make sure there is\nno out of bounds access.\n\nMake sure the stack and data offsets are aligned to\nthe 32K TLB size.\n\nCheck that the FW microcode actually fits in the\nspace that is reserved for it.\n\n(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)",
  "id": "GHSA-q3hq-vwmg-m826",
  "modified": "2026-07-27T06:30:40Z",
  "published": "2026-07-25T12:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64516"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-64516 (GCVE-0-2026-64516)

Vulnerability from cvelistv5 – Published: 2026-07-25 09:14 – Updated: 2026-08-05 12:42

Title

drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the actual FW at an offset, but it was not calculated into the VCPU BO size. Subtract this from the FW size to make sure there is no out of bounds access. Make sure the stack and data offsets are aligned to the 32K TLB size. Check that the FW microcode actually fits in the space that is reserved for it. (cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/ce0de178ef08408f6…
https://git.kernel.org/stable/c/3e5a1d5bb2ff061e6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f , < ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4 (git) Affected: d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f , < 3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 (git)
Linux	Linux	Affected: 6.19 Unaffected: 0 , < 6.19 (semver) Unaffected: 7.0.11 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4",
              "status": "affected",
              "version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
              "versionType": "git"
            },
            {
              "lessThan": "3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3",
              "status": "affected",
              "version": "d4a640d4b9f34aa9472c71986ef4b5a42dbe4f0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/vce_v1_0.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce1: Fix VCE 1 firmware size and offsets\n\nThe VCPU BO contains the actual FW at an offset, but\nit was not calculated into the VCPU BO size.\nSubtract this from the FW size to make sure there is\nno out of bounds access.\n\nMake sure the stack and data offsets are aligned to\nthe 32K TLB size.\n\nCheck that the FW microcode actually fits in the\nspace that is reserved for it.\n\n(cherry picked from commit c16fe59f622a080fc457a57b3e8f14c780699449)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches VCE1 through DRM command-submission ioctls on the local render device; there is no network or physical attack path.\nAC:L - An attacker can repeatedly submit VCE jobs and control session allocation and engine power-up without winning an uncontrollable race or relying on an unusual runtime condition.\nPR:L - The AMDGPU_CS ioctl is DRM_RENDER_ALLOW and contains no capability or DRM-master requirement, so ordinary users with render-node access can reach it.\nUI:N - Exploitation requires only attacker-controlled ioctl submissions and does not depend on another user opening content or performing an action.\nS:C - The VCE VCPU operates through direct GPU/GART addresses with its VM control disabled, so access beyond the kernel VCPU BO crosses the GPU DMA memory-isolation boundary.\nC:H - The oversized and misaligned read/write cache windows can expose adjacent VRAM or GART-backed memory outside the VCPU BO, potentially permitting disclosure of high-value memory.\nI:H - The VCE data and stack windows are writable, so their out-of-bounds placement can corrupt adjacent GPU or GART-backed allocations and potentially affect execution or protected data.\nA:H - The invalid firmware layout can cause VCE VM faults, firmware failure, or a GPU/card lockup, and an unprivileged attacker can repeatedly reactivate the engine to reproduce the disruption."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:42:33.445Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3"
        }
      ],
      "title": "drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64516",
    "datePublished": "2026-07-25T09:14:43.142Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-08-05T12:42:33.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-Q3HQ-VWMG-M826

CVE-2026-64516 (GCVE-0-2026-64516)

Tags

Sightings

Nomenclature

Related by attack behaviour