CVE-2026-46218: AMD GPU Bounds Checking Vulnerability in Linux Kernel

Technical summary

CVE-2026-46218 addresses missing bounds validation in the amdgpu DRM driver's instruction buffer (IB) handling for video codec engines. The uvd/vce/vcn code paths call ib_get_value() and ib_set_value() functions that access predetermined offsets within instruction buffers without verifying the IB length is sufficient. This can lead to out-of-bounds memory reads or writes. The patch introduces bounds checking before these accesses and changes the idx parameter from a signed to unsigned 32-bit integer to eliminate potential overflow conditions that could allow malicious code to bypass the new checks.

Business impact

Systems running vulnerable Linux kernels with AMD GPU support are at risk of local privilege escalation and denial of service. A local unprivileged user could read privileged kernel memory (information disclosure) or crash the system. Environments with shared compute resources (HPC clusters, cloud instances with GPU pass-through, or workstations with untrusted user access) face the highest risk. Data centers running AMD-based GPU infrastructure should treat this as a stability and confidentiality concern.

Affected systems

The Linux kernel is affected. The vulnerability is specific to systems with AMD GPU hardware where the amdgpu driver is loaded and the video codec engines (UVD, VCE, or VCN) are accessible to local users. This includes AMD Radeon GPUs and EPYC systems with GPU acceleration. Verify your kernel version and GPU driver configuration against the vendor advisory to confirm exposure.

Exploitability

Exploitability is moderate to high for at-risk systems. The attack vector is local, requiring an attacker to already have user-level access to the system. No user interaction is required once access is obtained. The attack surface is the video codec instruction buffer processing, which may be triggered through graphics APIs or compute frameworks that utilize GPU video acceleration. However, exploitation requires specific knowledge of buffer layout and careful crafting of input to trigger the out-of-bounds access reliably.

Remediation

Apply the Linux kernel patch that adds bounds checking to the ib_get_value() and ib_set_value() functions in the amdgpu driver. Verify the patched kernel version against your distribution's security advisory. Additionally, restrict local system access to trusted users only, as this vulnerability requires local authentication. Systems that do not use AMD GPU hardware or have GPU access disabled are not affected.

Patch guidance

Monitor your Linux distribution's security announcements for a patched kernel version incorporating this fix. The patch has been integrated into the Linux kernel upstream. Apply kernel updates from your distribution as soon as they become available and test in non-production environments first. Depending on your distribution and kernel series, the patch may arrive through regular updates or as a targeted security release. Verify the kernel changelog mentions bounds checking additions to the amdgpu video codec functions before deploying.

Detection guidance

Monitor system logs for GPU driver errors, segmentation faults, or kernel panics related to amdgpu, uvd, vce, or vcn subsystems, particularly if they correlate with graphics or compute workload activity. Inspect running kernel version via 'uname -r' and cross-reference against your vendor's list of patched versions. Network-based detection is not possible as this is a local privilege escalation vector. Endpoint detection tools that monitor system calls to GPU driver interfaces may detect exploit attempts in advanced environments. Review GPU access permissions and which users can invoke GPU compute resources.

Why prioritize this

This vulnerability merits prompt attention because it enables local privilege escalation and information disclosure on GPU-equipped systems. The CVSS 3.1 score of 7.1 (HIGH) reflects high confidentiality and availability impact accessible to local users. While the barrier to exploitation is higher than remote attacks, the combination of memory disclosure and crash capabilities on shared systems presents meaningful risk. Systems in multi-tenant or HPC environments should prioritize patching. Standard endpoints and servers without AMD GPU support can be deprioritized.

Risk score, explained

The CVSS 3.1 score of 7.1 is derived from local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), no integrity impact (I:N), and high availability impact (A:H). This reflects that a local, low-privileged user can reliably trigger the vulnerability to read kernel memory or crash the system, but remote exploitation is not possible and integrity is not directly compromised.

Frequently asked questions