CVE-2026-74417

A flaw was found in the Linux kernel's drm/radeon component. An integer overflow vulnerability exists in the radeon_align_pitch() function. This flaw occurs when calculating memory alignment and pitch, where large values can cause the calculations to wrap around. If exploited, this could lead to the creation of an invalid pitch or a zero-sized buffer, potentially resulting in a Denial of Service (DoS) condition for the system.

An integer overflow in the DRM/Radeon dumb buffer creation path can occur in radeon_align_pitch when rounding up the pitch or multiplying the aligned value by bytes per pixel. A local process with access to the Radeon DRM device can request crafted width and bpp values that make the helper return an invalid pitch or zero, which can lead to an invalid or zero sized GEM dumb buffer. For the CVSS the PR:L is used because reliable triggering requires local access to the DRM device node, often through a logged in user session or video/render device permissions. The issue is not network reachable. Impact is at least local denial of service through invalid graphics buffer state or driver failure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.