CVE-2026-23468

A flaw was found in the Linux kernel's drm/amdgpu component. A local user can exploit this vulnerability by providing an excessively large number of Buffer Object (BO) list entries through the bo_number field. This can lead to excessive memory allocation and prolonged processing times, potentially causing a memory exhaustion attack and resulting in a Denial of Service (DoS) for the system.

This vulnerability is rated as having Moderate impact because it requires local access with permissions to interact with the AMD GPU rendering device nodes and is limited to causing a denial of service via memory exhaustion, without permitting privilege escalation or information leakage. The flaw exclusively affects environments with supported AMD graphics cards where the amdgpu kernel module is loaded and accessible. Headless server deployments and systems utilizing alternative display controllers or virtual graphics adapters do not expose this interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.