CVE-2026-46237: drm/amdgpu/vcn3: Avoid overflow on msg bound check

Synopsis

An integer overflow vulnerability exists in the Linux kernel's amdgpu VCN3 video codec driver, specifically in the message bounds-checking logic. The flaw is reachable locally by a low-privileged user who has access to the affected DRM device node, with no network exposure required. Successful exploitation allows an attacker to read sensitive kernel memory and trigger a system crash or denial of service. A patched-image rebuild at the fix versions is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to reach the vulnerable DRM device node; no elevated or administrative privileges are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the overflow entirely through their own process.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout requirements need to be satisfied.

Blast Radius

• A successful attacker reads kernel memory contents accessible through the overflowed bounds check, which may include sensitive data from other processes or kernel structures such as credentials and keys.
• The overflow can corrupt kernel state in a way that crashes the affected host, causing a full denial of service for all workloads running on that node.