CVE-2026-46204: Linux Kernel AMD GPU Out-of-Bounds Read – VCN4 Parser Vulnerability

Technical summary

CVE-2026-46204 is an out-of-bounds read vulnerability in the amdgpu/vcn4 subsystem of the Linux kernel. The instruction buffer (IB) parser lacks sufficient bounds validation when processing user-supplied data structures. An attacker can craft a malicious IB that causes the parser to read memory outside its intended boundaries. The vulnerability is resolved by replacing the vulnerable parsing logic with calls to amdgpu_ib_get_value(), a helper function that enforces bounds checking on all memory accesses. This is classified as CWE-125 (Out-of-bounds Read).

Business impact

Systems running affected Linux kernels with AMD GPU support are vulnerable to local privilege escalation and information disclosure. An unprivileged user can read sensitive kernel memory, potentially recovering cryptographic material, authentication tokens, or other secrets. Attackers can also trigger kernel panics, causing service disruptions on affected hosts. For organizations operating AMD GPU-based compute clusters, container orchestration platforms, or workstations, this vulnerability can be weaponized to break isolation between tenants or users.

Affected systems

The Linux kernel with amdgpu/vcn4 driver support is affected. This includes systems with AMD RDNA or RDNA2-class GPUs running vulnerable kernel versions. The vulnerability requires local code execution; remote exploitation is not possible. Container environments, multi-tenant systems, and HPC clusters with GPU acceleration are at particular risk.

Exploitability

Exploitability is moderate to high for systems where untrusted users have local access. The vulnerability requires local user privileges (not root), and no user interaction is required—an attacker simply needs to send a crafted instruction buffer to the GPU driver. The attack surface is limited to systems where the amdgpu driver is loaded and accessible from unprivileged user space. No public exploit code has been designated for KEV inclusion as of this advisory.

Remediation

Apply a Linux kernel update that includes the fix for CVE-2026-46204. Verify against your vendor's advisory or the upstream Linux kernel commit for the exact patched version applicable to your distribution and kernel series. In parallel, enforce principle of least privilege by restricting GPU driver access to trusted users only, and consider disabling GPU features if they are not required.

Patch guidance

Obtain updates from your Linux distribution's security channel (RHEL, Ubuntu, Debian, SUSE, etc.) or directly from kernel.org if running an unmodified upstream kernel. Verify the fix is included by checking the kernel version and confirming the presence of the amdgpu_ib_get_value() bounds-checking calls in the vcn4 parser. Test patches in a non-production environment first, as GPU driver updates may affect workload performance or stability in edge cases.

Detection guidance

Monitor kernel logs for GPU driver errors, segmentation faults, or out-of-bounds access warnings originating from the amdgpu/vcn4 subsystem. Implement runtime integrity monitoring on systems where untrusted code execution is possible. Audit access to GPU device files (/dev/dri/*) to identify unexpected user attempts to interact with the GPU. Use kernel module introspection to confirm that the unpatched vcn4 parser is not in use.

Why prioritize this

This vulnerability merits immediate attention because it combines local privilege escalation, information disclosure, and denial-of-service potential in a commonly accessible driver subsystem. The CVSS 3.1 score of 7.1 (HIGH) reflects the high impact on confidentiality and availability. While exploitation requires local access, the barrier to entry is low for users on affected systems. Multi-tenant environments and systems permitting untrusted user code should prioritize patching.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) yields a score of 7.1 (HIGH). The attack vector is local (AV:L), attack complexity is low (AC:L), and only low privileges are required (PR:L). There is no user interaction needed (UI:N) and the scope is unchanged (S:U). The vulnerability has high impact on confidentiality (C:H)—kernel memory disclosure—and high impact on availability (A:H)—potential kernel panic. Integrity is not impacted (I:N) because the vulnerability is read-only.

Frequently asked questions