CVE-2026-23468 drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
A local attacker can cause resource exhaustion and denial of service in the Linux kernel by submitting excessive buffer object list entries to the amdgpu driver.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23468?
CVE-2026-23468 is a medium-severity denial of service vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times.
Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance.
Return -EINVAL if the requested entry count exceeds the limit
(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)
Weakness: CWE-770
Which versions are affected by CVE-2026-23468?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23468?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23468 being exploited?
There is no known exploitation of CVE-2026-23468 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-81840, BELL-CVE-2026-23468, DEBIAN-CVE-2026-23468, GHSA-mgj5-5f6h-8742, ROOT-OS-DEBIAN-11-CVE-2026-23468, ROOT-OS-DEBIAN-12-CVE-2026-23468 and 4 more.