---
id: CVE-2026-74417
title: 'drm/radeon: fix integer overflow in radeon_align_pitch()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/radeon: fix integer overflow in radeon_align_pitch()

  radeon_align_pitch() has the same kind of overflow issue as the old
  amdgpu helper: both the alignment round-up…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ff72145badb834e8051719ea66e024784d000cb4 <
    b7b44937c548c2c987fcdd129f8896741004bed6
  - >-
    Linux >= ff72145badb834e8051719ea66e024784d000cb4 <
    415bb9893e249e46aa5159f7363a11512cf06fa9
  - >-
    Linux >= ff72145badb834e8051719ea66e024784d000cb4 <
    d9dfa176899d488e48bb7342d2c43ddd36e66318
  - >-
    Linux >= ff72145badb834e8051719ea66e024784d000cb4 <
    dfc7b5b5599472277e71e5bd2712740651c7c5be
  - >-
    Linux >= ff72145badb834e8051719ea66e024784d000cb4 <
    ce3b24eb3ee8f82de851535f516bf21f83e82259
  - Linux 2.6.39
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:56:15.722090Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:44.717Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74417'
references:
  - url: 'https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6'
  - url: 'https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9'
  - url: 'https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318'
  - url: 'https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be'
  - url: 'https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06546
ingestedAt: '2026-10-16T19:46:24.364Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix integer overflow in radeon_align_pitch()

radeon_align_pitch() has the same kind of overflow issue as the old
amdgpu helper: both the alignment round-up add and the final
'aligned * cpp' calculation can overflow signed int.

If that wraps, radeon_mode_dumb_create() can end up returning an
invalid pitch or creating a zero-sized dumb buffer.

Fix this by using check_add_overflow() for the alignment round-up and
check_mul_overflow() for the final pitch calculation, returning 0 on
overflow. Also reject zero pitch and size in
radeon_mode_dumb_create().

Found via AST-based call-graph analysis using sqry.

## Affected

- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < b7b44937c548c2c987fcdd129f8896741004bed6`
- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < 415bb9893e249e46aa5159f7363a11512cf06fa9`
- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < d9dfa176899d488e48bb7342d2c43ddd36e66318`
- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < dfc7b5b5599472277e71e5bd2712740651c7c5be`
- `Linux >= ff72145badb834e8051719ea66e024784d000cb4 < ce3b24eb3ee8f82de851535f516bf21f83e82259`
- `Linux 2.6.39`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.