CVE-2026-64516

A flaw was found in the Linux kernel's drm/amdgpu/vce1 component. The vulnerability arises from incorrect calculations of the VCE 1 firmware size and offsets, which could lead to an out-of-bounds access. This issue could potentially allow a local attacker to cause system instability or a denial of service (DoS) by manipulating the firmware handling.

This vulnerability is rated as Moderate severity because exploitation requires local access and is constrained to systems equipped with legacy AMD graphics hardware utilizing the first-generation Video Compression Engine (VCE 1.0). An attacker capable of triggering improper firmware buffer boundary handling can cause an out-of-bounds access, resulting in a kernel denial of service or system crash. Because the defect cannot be triggered remotely and does not directly permit arbitrary code execution or privilege escalation, the overall operational risk to typical Red Hat deployments remains limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.