{"id":"CVE-2026-74417","title":"drm/radeon: fix integer overflow in radeon_align_pitch()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ff72145badb834e8051719ea66e024784d000cb4 < b7b44937c548c2c987fcdd129f8896741004bed6","Linux >= ff72145badb834e8051719ea66e024784d000cb4 < 415bb9893e249e46aa5159f7363a11512cf06fa9","Linux >= ff72145badb834e8051719ea66e024784d000cb4 < d9dfa176899d488e48bb7342d2c43ddd36e66318","Linux >= ff72145badb834e8051719ea66e024784d000cb4 < dfc7b5b5599472277e71e5bd2712740651c7c5be","Linux >= ff72145badb834e8051719ea66e024784d000cb4 < ce3b24eb3ee8f82de851535f516bf21f83e82259","Linux 2.6.39"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T18:56:15.722090Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:44.717Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74417","references":[{"url":"https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6"},{"url":"https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9"},{"url":"https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318"},{"url":"https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be"},{"url":"https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06546,"ingestedAt":"2026-10-16T19:46:24.364Z","slug":"CVE-2026-74417","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n'aligned * cpp' calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry.\n\n## Affected\n\n- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < b7b44937c548c2c987fcdd129f8896741004bed6`\n- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < 415bb9893e249e46aa5159f7363a11512cf06fa9`\n- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < d9dfa176899d488e48bb7342d2c43ddd36e66318`\n- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < dfc7b5b5599472277e71e5bd2712740651c7c5be`\n- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < ce3b24eb3ee8f82de851535f516bf21f83e82259`\n- `Linux 2.6.39`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}