Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate GEM_CREATE domain combinations AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:08.400Z",
  "pubdate": "2026-08-26T15:17:08.400Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel's AMDGPU driver, specifically within the GEM_CREATE IOCTL interface.\nThe vulnerability arises from insufficient validation of memory domain combinations, allowing userspace applications to pass invalid bitmasks.\nBy providing combinations of memory domains (such as VRAM combined with GDS or GWS), a local attacker can force the driver to exceed its maximum allowed placement configurations.\nThis violation triggers a kernel BUG_ON() condition, resulting in a Denial of Service (DoS) via kernel panic.\nThe flaw affects the amdgpu_gem_create_ioctl function, which lacks the necessary logic to enforce domain exclusivity for specialized memory regions.\nThere are no requirements for external network access or elevated privileges beyond the ability to interact with the DRM/KMS device node, which is typically accessible to users in the video group.\nThe impact is limited to system stability; successful exploitation results in immediate system termination.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within the AMDGPU Graphics Execution Manager (GEM) creation path. Specifically, the amdgpu_gem_create_ioctl function performs checks against a generic bitmask (AMDGPU_GEM_DOMAIN_MASK) but fails to enforce logical constraints on the specific memory domains requested.\nThe Linux kernel's AMDGPU driver manages memory via various domains, including CPU, GTT (Graphics Translation Table), VRAM (Video RAM), and specialized regions such as DOORBELL, GDS (Global Data Store), GWS (Global Wavefront Store), and OA (Opcodes/Arithmetic).\nInternally, the driver translates these domain requests into placement structures through the amdgpu_bo_placement_from_domain() helper function. This function has a hardcoded limit on the number of concurrent placements it can handle, defined by AMDGPU_BO_MAX_PLACEMENTS.\nWhen a malicious userspace application provides a combined bitmask that mixes standard domains (CPU, GTT, VRAM) with privileged or restricted domains (DOORBELL, GDS, GWS, OA), the resulting array of placements exceeds the capacity defined by AMDGPU_BO_MAX_PLACEMENTS.\nThe exploitation flow is as follows: 1) An attacker opens the /dev/dri/renderD* device file. 2) The attacker issues an IOCTL_AMDGPU_GEM_CREATE request with a crafted 'domain' field containing invalid bitmask combinations. 3) The kernel driver processes these domains without correctly identifying the invalid overlapping configuration. 4) The driver proceeds to call amdgpu_bo_placement_from_domain(), which iterates through the requested domains and attempts to populate a fixed-size array. 5) As the array limit is exceeded, the code triggers a BUG_ON() statement, which is a non-recoverable assertion failure designed to protect kernel integrity from out-of-bounds memory writes.\nBecause BUG_ON() halts the kernel execution flow immediately, this vulnerability functions as a reliable local DoS vector. The exploit is deterministic and does not require complex heap grooming or race conditions; it is triggered solely by the submission of an invalid IOCTL argument. The vulnerability exists within the amdgpu_gem_create_ioctl entry point, affecting all versions of the driver that implement the current GEM placement logic and pre-date the implementation of amdgpu_gem_are_domains_valid()."
}