{"id":"CVE-2026-68108","title":"drm/amdgpu/vce: fix integer overflow in image size","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536×65536) cause …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 893db20383800cfe92e638705984eebb13bc81a5","Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a07430abd556de3707adfcadcc60db3fa64e4b2b","Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a6d7065b91a14790980ce6f4960db0ca8c3c9940","Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 7eebef042c12dfe0568593ee6a8926d16505925e","Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 00c311a13d225266800c712f2b7db2711c6897de","Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 186bfdc4e26d019b2e7570cb121964a1d89b2e5b","Linux 4.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:43:59.908598Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:57.212Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68108","references":[{"url":"https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5"},{"url":"https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b"},{"url":"https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940"},{"url":"https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e"},{"url":"https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de"},{"url":"https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b"}],"tags":["cve.org"],"epss":0.00136,"epssPercentile":0.02675,"ingestedAt":"2026-10-16T17:24:46.839Z","slug":"CVE-2026-68108","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vce: fix integer overflow in image size\n\nFix a security vulnerability where malicious VCE command streams\nwith oversized dimensions (e.g. 65536×65536) cause 32-bit integer\noverflow, wrapping the calculated buffer size to 0. This bypasses\nvalidation and allows GPU firmware to perform out-of-bound memory\naccess.\n\nThe fix uses 64-bit arithmetic to detect overflow and rejects\ninvalid dimensions before they reach the hardware.\n\nV2: remove redundant check\nV3: modify max height value\nV4: remove size64\n\n(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)\n\n## Affected\n\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 893db20383800cfe92e638705984eebb13bc81a5`\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a07430abd556de3707adfcadcc60db3fa64e4b2b`\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a6d7065b91a14790980ce6f4960db0ca8c3c9940`\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 7eebef042c12dfe0568593ee6a8926d16505925e`\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 00c311a13d225266800c712f2b7db2711c6897de`\n- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 186bfdc4e26d019b2e7570cb121964a1d89b2e5b`\n- `Linux 4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}