CVE-2026-89818

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An integer overflow exists in the drm/amdgpu/vcn component during the dec msg buffer count check. When the num buffers variable is set to 0x3FFFFFFF, the calculation 6 + num buffers * 4 wraps to 2, allowing the bounds check to pass. This enables the parser to loop beyond the end of the message BO (Buffer Object). Exploitation requires a mapping of approximately 4GiB to bypass the initial header size check.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.