CVE-2026-68107
drm/amdgpu/vcn4: avoid rereading IB param length
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.148, 6.12.101, 6.2, 6.17, 6.18.42, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. (cherry picked from commit dbb02b4755f8c1f3773263f2d779872c1c0c073a)
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 6.6.107 · fixed in 6.6.148; From 6.12.48 · fixed in 6.12.101; From 6.1.191 · fixed in 6.2; From 6.16.8 · fixed in 6.17
- Linux Linux
6.17
- KernelLinux
fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.17.0 · fixed in 7.1.6