CVE-2026-46230: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's AMD GPU VCN3 (Video Core Next) driver, specifically in the decode-message parsing path. The flaw is reachable locally by a process with a low-privilege account and requires no user interaction. Successful exploitation allows an attacker to read kernel memory contents and can also trigger a denial-of-service condition. Patched-image rebuilds at the fixed kernel versions (6.6.140, 6.12.90, 6.18.32, and the upstream commit) are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access path is required to trigger this vulnerability.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or special permissions are needed beyond a basic user session.

• Victim interactionNot required

  No victim action is needed; the attacker can trigger the vulnerable code path unilaterally.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads kernel memory contents outside the intended buffer boundary, which may expose sensitive data such as kernel pointers, credentials, or other process memory.
• Crashes or destabilizes the affected kernel subsystem (AMD VCN3 video decoder), causing denial of service for GPU-accelerated video decode workloads on the host.