CVE-2026-68276 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow
The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault.
The IB only needs to be a minimal NOP shell to schedule the job; the cleaner shader itself is emitted on the ring via emit_cleaner_shader(). Fill 16 dwords to match the allocation.
v2: Use ib_size_dw variable (Lijo)
(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the AMDGPU driver component of the Linux kernel within the direct rendering manager subsystem. The issue manifests in the cleaner shader functionality where a buffer overflow occurs due to incorrect memory management during shader execution. The vulnerability specifically affects the graphics command submission process on AMD GPU hardware through the amdgpu driver implementation. The flaw resides in how the driver handles internal buffer allocation for cleaner shader operations, creating a classic buffer overflow condition that can lead to system instability.
The technical root cause involves improper buffer sizing calculations within the graphics command processing pipeline. The system allocates a 16-dword (64-byte) indirect buffer but then incorrectly fills it with (align_mask + 1) dwords where align_mask equals 0xff, resulting in 256 dwords being written into the 64-byte allocation. This represents a direct violation of memory boundary constraints and constitutes a classic buffer overflow vulnerability that can be classified under CWE-121 as an insufficient boundary checking. The overflow occurs during the preparation phase of graphics command submission where kernel page faults are generated when attempting to write beyond allocated memory boundaries.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable privilege escalation or denial of service conditions within the graphics subsystem. When the kernel attempts to execute graphics commands through the AMDGPU driver, the buffer overflow causes immediate kernel page faults that terminate the graphics processing operations. This affects systems running Linux kernels with AMDGPU drivers, particularly those utilizing newer graphics hardware that relies on the cleaner shader functionality for memory management operations. The vulnerability impacts both desktop and server environments where AMD GPUs are deployed, potentially affecting applications requiring graphics acceleration or GPU compute workloads.
The fix implements a targeted correction to ensure buffer sizing matches actual usage requirements while maintaining operational compatibility with existing graphics processing pipelines. The solution modifies the buffer population logic to write exactly 16 dwords as allocated, rather than the incorrect 256 dwords that previously caused overflow conditions. This approach aligns with proper defensive programming practices and follows industry standards for memory management in kernel space operations. The change specifically addresses the mismatch between allocation size and actual usage through the ib_size_dw variable reference, ensuring that all graphics command buffers maintain proper sizing constraints.
This vulnerability demonstrates characteristics consistent with ATT&CK technique T1068 which involves local privilege escalation through kernel exploits, though the current implementation only results in denial of service. The fix represents a standard memory safety correction that prevents unauthorized memory access patterns while maintaining system stability. Implementation of this patch requires kernel updates to ensure proper graphics command processing on AMDGPU hardware and addresses potential security implications associated with uncontrolled memory access in kernel modules. The solution follows established kernel development practices for buffer management and memory allocation, ensuring compatibility with existing driver interfaces while preventing the overflow condition that could lead to more serious system compromise scenarios.