CVE-2026-68108

A flaw was found in the drm/amdgpu/vce component of the Linux kernel. Malicious VCE (Video Codec Engine) command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead to system instability or potentially arbitrary code execution.

This vulnerability is rated as Important rather than Moderate because an unprivileged local attacker with access to direct rendering infrastructure can cause out-of-bounds kernel memory corruption, potentially achieving privilege escalation or a complete kernel denial of service. Exploitation requires environments equipped with physical or passed-through AMD graphics hardware utilizing the Video Codec Engine (VCE). Systems running typical server installations without AMD graphics processing units or where unprivileged users lack access to DRM device nodes are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If AMD GPU Video Codec Engine (VCE) functionality is not required, the amdgpu kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module.

To blacklist the amdgpu module, create a file named /etc/modprobe.d/blacklist-amdgpu.conf with the following content:

blacklist amdgpu

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use.