CVE-2026-74417 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/radeon: fix integer overflow in radeon_align_pitch()
radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int.
If that wraps, radeon_mode_dumb_create() can end up returning an invalid pitch or creating a zero-sized dumb buffer.
Fix this by using check_add_overflow() for the alignment round-up and check_mul_overflow() for the final pitch calculation, returning 0 on overflow. Also reject zero pitch and size in radeon_mode_dumb_create().
Found via AST-based call-graph analysis using sqry.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question affects the radeon graphics driver within the Linux kernel, specifically targeting the radeon_align_pitch() function where integer overflow conditions can lead to critical system instability. This issue represents a classic case of signed integer overflow that can be exploited to create invalid memory allocations and potentially enable privilege escalation or denial of service attacks. The flaw stems from improper handling of arithmetic operations that exceed the maximum representable value for signed 32-bit integers, creating opportunities for attackers to manipulate memory layout and buffer sizes.
The technical implementation of this vulnerability occurs through two distinct overflow points within the radeon_align_pitch() function. First, the alignment round-up addition operation can overflow when adding the alignment offset to the base pitch value, and second, the final calculation involving 'aligned * cpp' (color per pixel) multiplication can also overflow due to the same signed integer limitations. Both operations utilize standard arithmetic without proper overflow checking mechanisms, allowing the kernel to compute incorrect values that subsequently propagate through the graphics subsystem. This type of vulnerability aligns with CWE-190, which specifically addresses integer overflow conditions in software implementations.
The operational impact of this vulnerability extends beyond simple memory corruption, as it directly affects the radeon_mode_dumb_create() function that manages graphics buffer creation. When integer overflows occur, the system may return invalid pitch values or create zero-sized dumb buffers, which can cause crashes in graphics applications and potentially lead to privilege escalation if attackers can manipulate these conditions systematically. The vulnerability's exploitation pathway through AST-based call-graph analysis using sqry demonstrates how modern static analysis tools can identify such subtle but critical flaws in kernel code that might otherwise remain undetected during routine code reviews.
The mitigation strategy implemented addresses the core issue by incorporating proper overflow detection mechanisms throughout the affected functions. Specifically, check_add_overflow() is utilized for the alignment round-up operations to detect when addition operations exceed integer limits, while check_mul_overflow() is applied to the final pitch calculation to prevent multiplication overflows that could result in invalid buffer sizes. Additionally, the fix includes explicit validation of pitch and size parameters within radeon_mode_dumb_create(), rejecting zero values that would otherwise lead to undefined behavior. This approach aligns with the ATT&CK framework's defense evasion techniques by ensuring proper input validation and overflow protection mechanisms are in place to prevent exploitation attempts. The comprehensive nature of this fix ensures that all potential overflow paths are addressed while maintaining system stability and preventing unauthorized access to kernel memory spaces through carefully crafted graphics buffer requests.