---
id: CVE-2026-46204
title: 'drm/amdgpu/vcn4: Prevent OOB reads when parsing IB'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

  Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the
  bounds checks.
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0b15205c7325dc20b7da0068307670d222d66949 <
    1dc005775fb5b3f86464406452b17364f85581d3
  - >-
    Linux >= 0b15205c7325dc20b7da0068307670d222d66949 <
    d0802a8877d730260d4af4dd4e0b6cde7e0e593f
  - >-
    Linux >= 0b15205c7325dc20b7da0068307670d222d66949 <
    a6d5563ba1f03a049561cd347574613167294e8d
  - >-
    Linux >= 0b15205c7325dc20b7da0068307670d222d66949 <
    5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1
  - >-
    Linux >= 0b15205c7325dc20b7da0068307670d222d66949 <
    2444eb0ec8283f4a3845eb7febad378476e1ba3c
  - Linux 6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:21:08.264110Z'
published: '2026-05-28'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:31:08.011Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46204'
references:
  - url: 'https://git.kernel.org/stable/c/1dc005775fb5b3f86464406452b17364f85581d3'
  - url: 'https://git.kernel.org/stable/c/d0802a8877d730260d4af4dd4e0b6cde7e0e593f'
  - url: 'https://git.kernel.org/stable/c/a6d5563ba1f03a049561cd347574613167294e8d'
  - url: 'https://git.kernel.org/stable/c/5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1'
  - url: 'https://git.kernel.org/stable/c/2444eb0ec8283f4a3845eb7febad378476e1ba3c'
tags:
  - cve.org
epss: 0.00131
epssPercentile: 0.02388
ingestedAt: '2026-10-16T17:24:46.712Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vcn4: Prevent OOB reads when parsing IB

Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the
bounds checks.

## Affected

- `Linux >= 0b15205c7325dc20b7da0068307670d222d66949 < 1dc005775fb5b3f86464406452b17364f85581d3`
- `Linux >= 0b15205c7325dc20b7da0068307670d222d66949 < d0802a8877d730260d4af4dd4e0b6cde7e0e593f`
- `Linux >= 0b15205c7325dc20b7da0068307670d222d66949 < a6d5563ba1f03a049561cd347574613167294e8d`
- `Linux >= 0b15205c7325dc20b7da0068307670d222d66949 < 5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1`
- `Linux >= 0b15205c7325dc20b7da0068307670d222d66949 < 2444eb0ec8283f4a3845eb7febad378476e1ba3c`
- `Linux 6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.