Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89818— drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： drm/amdgpu/vcn：修复 dec_msg 缓冲区数量检查中的整数溢出问题 如果传入的 （即 ）的值为 ，表达式 会发生整型回绕，结果变为 ，导致边界检查通过，使得解析器循环远超消息 BO（Buffer Object）的末尾。要触发此问题，还需一个约 4GiB 的映射，以确保 能通过之前“头部无法容纳在 BO 中”的检查。 修复方式：将测试改写为除法形式，该形式从构造上避免了溢出。同时更新提示信息，以反映 无效的情况。

CVSS 7.1 · High EPSS 0.16% · P5

Affected Version Matrix 27

VendorProduct Version RangeStatus
Linux Linux 88411caee8f576d6b5abf6531232fcc0ce756dc5< c2340281be4ddacb8c203e2bce59b126d1d6c4c8 affected
c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e< 6dceaeceaa7c8396339f3ea34b0110cb912ca61b affected
7688143ca62edeecacb3ba0a2cea129dbd262a18< 47799e1f893d47d8af231710a61065e3ec8a13e8 affected
63b51e8a9d54317d31cc3856c1e12407070d5fc2< 7e28853c78c20bb8ba4c1dba702430cd05e09f76 affected
b193019860d61e92da395eae2011f2f6716b182f< 9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3 affected
b193019860d61e92da395eae2011f2f6716b182f< 4d7390530853eb7befda9cc786e4c86e8ad7ac9e affected
f55552adb100eb54a6e6dabff4fbdc8679bd3fa0 affected
82c535eff05490c71153af57de9fe85502fcb5d5 affected
… +19 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89818

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 88411caee8f576d6b5abf6531232fcc0ce756dc5 ~ c2340281be4ddacb8c203e2bce59b126d1d6c4c8 -
Linux Linux 7.1 -

II. Public POCs for CVE-2026-89818

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89818

请登录查看更多情报信息。

Other References for CVE-2026-89818 (6)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89818

No comments yet

Leave a comment