CVE-2026-46199: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's amdgpu DRM driver, specifically in the VCN4 video decode message parser. A local attacker with a low-privilege account can trigger the flaw without any network access or user interaction, causing the kernel to read memory beyond an allocated buffer object. Successful exploitation leaks sensitive kernel memory contents and can crash the affected system. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path in the amdgpu VCN4 decode message parser.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the out-of-bounds read entirely through their own actions.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout requirements are needed to trigger the read.

Blast Radius

• Reads kernel memory beyond the bounds of the allocated buffer object, potentially exposing sensitive kernel data such as heap contents, pointers, or credentials resident in adjacent memory.
• Triggers a kernel crash (denial of service) on the affected host, taking down all processes and workloads running on that node.