CVE-2026-80576

A flaw was found in the Linux kernel's drm/amdgpu component. A local attacker could exploit this vulnerability by providing oversized input buffer (IB) bytes to the amdgpu_cs_p2_ib() function on Graphics (GFX) rings. This lack of size validation allows the oversized values to corrupt adjacent control bits, which can destabilize command submission and potentially lead to a denial of service.

A flaw of moderate impact was found in the Linux kernel's AMD GPU driver (drm/amdgpu) as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. In the command submission path, amdgpu_cs_p2_ib() passed a user-supplied indirect buffer (IB) size through to ib->length_dw without validating it against the limit supported by the target ring, while ring_emit_ib() encodes that length into hardware packet fields. A local attacker with access to an AMD GPU could therefore submit a command stream with an oversized IB, causing high bits of the encoded length to corrupt adjacent control bits and destabilize command submission, resulting in a GPU hang or broader system instability (denial of service). Red Hat rates this flaw MODERATE (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access with low privileges and the established impact is limited to availability; this differs from the upstream CVE record's 8.8 (IMPORTANT) severity, which assumes high confidentiality and integrity impacts that the technical evidence does not establish. Fixes for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are currently deferred because this local, availability-only denial of service does not meet the criteria for an immediate update; the residual risk is that a local user with GPU device access could trigger a GPU hang or system instability. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel is out of support scope and will not receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to a kernel version that contains the upstream fix, once it becomes available for the affected Red Hat products, is the only way to address this issue.