Linux Kernel up to 7.2.6/7.3-rc2 amdgpu drm/amdgpu amdgpu_ttm_map_buffer buffer overflow

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.6/7.3-rc2. It has been classified as problematic. This impacts the function amdgpu_ttm_map_buffer of the file drm/amdgpu of the component amdgpu. This manipulation causes buffer overflow. This vulnerability appears as CVE-2026-97928. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 7.2.6/7.3-rc2. Affected by this vulnerability is the function amdgpu_ttm_map_buffer of the file drm/amdgpu of the component amdgpu. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used. v2: Let amdgpu_ttm_map_buffer() return whether the VMID 0 flush is needed, and drive the clear and copy paths from that. (Christian) v3: Make the vm_needs_flush output parameter mandatory instead of allowing NULL. (Christian) (cherry picked from commit a306e406e570b74318ff7d80e5b07b540ca1d3a9)

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2026-97928 since 09/25/2026. The exploitation appears to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2026).

Upgrading to version 7.2.7 or 7.3-rc3 eliminates this vulnerability. Applying the patch 241d7450cf75969cea450eb3e740cb9682f69c2f/87ceb8cba73d0b3c4025ff42495bccd8164acaed is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3-rc1
• 7.3-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion