{"id":"CVE-2026-68108","summary":"drm/amdgpu/vce: fix integer overflow in image size","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536×65536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)","modified":"2026-08-21T03:30:45.400011731Z","published":"2026-08-10T11:58:25.241Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68108.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de"},{"type":"WEB","url":"https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68108.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68108"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c"},{"fixed":"893db20383800cfe92e638705984eebb13bc81a5"},{"fixed":"a07430abd556de3707adfcadcc60db3fa64e4b2b"},{"fixed":"a6d7065b91a14790980ce6f4960db0ca8c3c9940"},{"fixed":"7eebef042c12dfe0568593ee6a8926d16505925e"},{"fixed":"00c311a13d225266800c712f2b7db2711c6897de"},{"fixed":"186bfdc4e26d019b2e7570cb121964a1d89b2e5b"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68108.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68108.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}