CVE-2026-68106 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix division by zero with invalid uvd dimensions
When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths.
Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values.
V2: Format change - move up all vaiable definitions. V3: Use warn_once to avoid spam.
(cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in question affects the amdgpu driver within the Linux kernel, specifically impacting the digital raster management subsystem responsible for handling video decoding operations. This issue manifests as a division by zero error that occurs during H264 and H264 Perf decode processing paths when encountering invalid UVD (Unified Video Decoder) frame dimensions. The root cause stems from insufficient input validation within the video decoding pipeline where width or height values less than 16 pixels trigger mathematical calculations that result in zero values for intermediate variables.
The technical flaw exploits a fundamental arithmetic dependency in the video decoding algorithm where width_in_mb and height_in_mb variables become zero when frame dimensions fall below the minimum threshold of 16 pixels. This zero value propagates through subsequent calculations to produce fs_in_mb as zero, ultimately causing a division by zero error when computing num_dpb_buffer parameter. This mathematical inconsistency represents a classic software bug pattern that can be classified under CWE-369, specifically involving divide-by-zero conditions in security-critical code paths.
The operational impact of this vulnerability extends beyond simple system crashes or hangs, potentially enabling denial of service attacks against systems running amdgpu drivers with video decoding capabilities. Attackers could exploit this weakness by feeding malformed video frames with dimensions below the acceptable threshold, causing kernel panics or system instability during video processing operations. The vulnerability affects both H264 and H264 Perf decode paths, indicating a broad scope of potential impact across different video decoding modes within the AMDGPU driver architecture.
The mitigation strategy implemented in this fix involves adding early validation checks to reject frames with width less than 16 pixels or height less than 16 pixels before any calculations dependent on these values are performed. This approach aligns with defensive programming principles and follows ATT&CK technique T1499.004 for resource exhaustion attacks by preventing malformed inputs from reaching critical arithmetic operations. The solution also incorporates warn_once functionality to prevent log spamming while maintaining visibility of the validation failures, demonstrating adherence to operational security best practices.
This vulnerability resolution demonstrates the importance of input validation in kernel space drivers where malformed data can lead to system instability and potential exploitation. The fix addresses a fundamental design flaw in the video decoding pipeline by implementing proper bounds checking before mathematical operations that could result in undefined behavior. The cherry-picked commit shows continuous improvement in maintaining code quality and security posture within the Linux kernel's graphics subsystem, ensuring that driver components properly handle edge cases and malformed inputs to prevent system-level failures.
The implementation of this fix represents a standard security hardening measure that aligns with industry best practices for kernel driver development and vulnerability remediation. By validating frame dimensions early in the processing pipeline, the amdgpu driver prevents potential exploitation vectors while maintaining compatibility with valid video decoding operations. The approach taken follows established patterns for handling boundary conditions in multimedia processing systems and demonstrates proper error handling within security-critical kernel components that process user-supplied data streams.