---
id: CVE-2026-68108
title: 'drm/amdgpu/vce: fix integer overflow in image size'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu/vce: fix integer overflow in image size

  Fix a security vulnerability where malicious VCE command streams
  with oversized dimensions (e.g. 65536×65536) cause …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    893db20383800cfe92e638705984eebb13bc81a5
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    a07430abd556de3707adfcadcc60db3fa64e4b2b
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    a6d7065b91a14790980ce6f4960db0ca8c3c9940
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    7eebef042c12dfe0568593ee6a8926d16505925e
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    00c311a13d225266800c712f2b7db2711c6897de
  - >-
    Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <
    186bfdc4e26d019b2e7570cb121964a1d89b2e5b
  - Linux 4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:43:59.908598Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:57.212Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68108'
references:
  - url: 'https://git.kernel.org/stable/c/893db20383800cfe92e638705984eebb13bc81a5'
  - url: 'https://git.kernel.org/stable/c/a07430abd556de3707adfcadcc60db3fa64e4b2b'
  - url: 'https://git.kernel.org/stable/c/a6d7065b91a14790980ce6f4960db0ca8c3c9940'
  - url: 'https://git.kernel.org/stable/c/7eebef042c12dfe0568593ee6a8926d16505925e'
  - url: 'https://git.kernel.org/stable/c/00c311a13d225266800c712f2b7db2711c6897de'
  - url: 'https://git.kernel.org/stable/c/186bfdc4e26d019b2e7570cb121964a1d89b2e5b'
tags:
  - cve.org
epss: 0.00136
epssPercentile: 0.02675
ingestedAt: '2026-10-16T17:24:46.839Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/vce: fix integer overflow in image size

Fix a security vulnerability where malicious VCE command streams
with oversized dimensions (e.g. 65536×65536) cause 32-bit integer
overflow, wrapping the calculated buffer size to 0. This bypasses
validation and allows GPU firmware to perform out-of-bound memory
access.

The fix uses 64-bit arithmetic to detect overflow and rejects
invalid dimensions before they reach the hardware.

V2: remove redundant check
V3: modify max height value
V4: remove size64

(cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)

## Affected

- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 893db20383800cfe92e638705984eebb13bc81a5`
- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a07430abd556de3707adfcadcc60db3fa64e4b2b`
- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < a6d7065b91a14790980ce6f4960db0ca8c3c9940`
- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 7eebef042c12dfe0568593ee6a8926d16505925e`
- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 00c311a13d225266800c712f2b7db2711c6897de`
- `Linux >= f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c < 186bfdc4e26d019b2e7570cb121964a1d89b2e5b`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.