CVE-2026-68107

A flaw was found in the Linux kernel. Specifically, within the drm/amdgpu/vcn4 component, a time-of-check to time-of-use (TOCTOU) vulnerability exists. This occurs because the system re-reads the IB parameter length instead of reusing an already obtained value. This could allow a local attacker to potentially manipulate the IB contents between reads, leading to unexpected behavior or a denial of service.

This issue affects AMDGPU systems using VCN 4 video encode. The driver re-reads IB parameter length from userspace IBs instead of reusing the validated value, creating a TOCTOU window. Systems without AMD GPUs are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.