CVE-2026-31766 drm/amdgpu: validate doorbell_offset in user queue creation
A missing bounds check in the amdgpu driver allows an integer overflow to corrupt kernel memory, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31766?
CVE-2026-31766 is a high-severity vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate doorbell_offset in user queue creation
amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space.
Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow.
(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)
Which versions are affected by CVE-2026-31766?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31766?
Apply the vendor's patch.
Is CVE-2026-31766 being exploited?
There is no known exploitation of CVE-2026-31766 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31766, DEBIAN-CVE-2026-31766, GHSA-gh3f-x9jp-jmhp, UBUNTU-CVE-2026-31766.