---
id: CVE-2026-80541
title: 'drm/amdgpu: validate GEM_CREATE domain combinations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: validate GEM_CREATE domain combinations

  AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,
  but did not validate domain combinations. Use…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    5c73485af7ad9c3ae592db3481f370bc07705391
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    584e3d47736fe2e7184ef3fc16b00b41485f96c6
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    66133fc05c3af002f45de8a71b833c026ccbfba6
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    ce5da474c3ddf7cccec5dce6aa4296297dd7caff
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    493355096e397f9217b41c8574ed2784c7351443
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    220aa2589d7321fb68d2e8597862711b5f22ae0b
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    80f0b53860d02577709d69a312a29ca674b9297c
  - >-
    Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd <
    5e9d136ad74df4edec67e502ce267597064d8f86
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:16:50.760391Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:25.405Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80541'
references:
  - url: 'https://git.kernel.org/stable/c/5c73485af7ad9c3ae592db3481f370bc07705391'
  - url: 'https://git.kernel.org/stable/c/584e3d47736fe2e7184ef3fc16b00b41485f96c6'
  - url: 'https://git.kernel.org/stable/c/66133fc05c3af002f45de8a71b833c026ccbfba6'
  - url: 'https://git.kernel.org/stable/c/ce5da474c3ddf7cccec5dce6aa4296297dd7caff'
  - url: 'https://git.kernel.org/stable/c/493355096e397f9217b41c8574ed2784c7351443'
  - url: 'https://git.kernel.org/stable/c/220aa2589d7321fb68d2e8597862711b5f22ae0b'
  - url: 'https://git.kernel.org/stable/c/80f0b53860d02577709d69a312a29ca674b9297c'
  - url: 'https://git.kernel.org/stable/c/5e9d136ad74df4edec67e502ce267597064d8f86'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02281
ingestedAt: '2026-10-16T19:46:24.319Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate GEM_CREATE domain combinations

AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK,
but did not validate domain combinations. Userspace could combine
CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making
amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and
hit BUG_ON().

Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/
VRAM domains to be specified one at a time. Return -EINVAL for invalid
combinations in amdgpu_gem_create_ioctl().

v2: Rename helper from amdgpu_gem_domain_valid() to
    amdgpu_gem_are_domains_valid() (Christian)

(cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080)

## Affected

- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 5c73485af7ad9c3ae592db3481f370bc07705391`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 584e3d47736fe2e7184ef3fc16b00b41485f96c6`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 66133fc05c3af002f45de8a71b833c026ccbfba6`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < ce5da474c3ddf7cccec5dce6aa4296297dd7caff`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 493355096e397f9217b41c8574ed2784c7351443`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 220aa2589d7321fb68d2e8597862711b5f22ae0b`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 80f0b53860d02577709d69a312a29ca674b9297c`
- `Linux >= 77a2faa55c1a497f4e7e89eabd11830f0e3cb3dd < 5e9d136ad74df4edec67e502ce267597064d8f86`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.