Linux Kernel up to 6.18.19/6.19.9/7.0-rc4 amdgpu bo_number resource consumption

Summaryinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.19/6.19.9/7.0-rc4. Affected by this issue is some unknown functionality of the component amdgpu. Performing a manipulation of the argument bo_number results in resource consumption. This vulnerability is known as CVE-2026-23468. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.19/6.19.9/7.0-rc4. This affects an unknown functionality of the component amdgpu. The manipulation of the argument bo_number with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-23468 since 01/13/2026. The exploitability is told to be difficult. Technical details are known, but no exploit is available.

Upgrading to version 6.18.20, 6.19.10 or 7.0-rc5 eliminates this vulnerability. Applying the patch 5ce4a38e6c2488949e373d5066303f9c128db614/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9/6270b1a5dab94665d7adce3dc78bc9066ed28bdd is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 7.0-rc1
• 7.0-rc2
• 7.0-rc3
• 7.0-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion