---
id: CVE-2026-80576
title: 'drm/amdgpu: reject oversized IBs with per-ring packet limits'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: reject oversized IBs with per-ring packet limits

  On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
  to ib->length_dw without a limit, wh…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    6e164ba1057175fb8a370d8e05cbff5c57eac0c8
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    1474f3970d1afd303e12ff14d06808eabb371576
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    07fe270ec07c138a70afe7a81e115a85c35c545c
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    fd37f9dd5b5ab70a46fa7bc76623c0528d602b27
  - Linux 4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:17:41.860241Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:27.703Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80576'
references:
  - url: 'https://git.kernel.org/stable/c/6e164ba1057175fb8a370d8e05cbff5c57eac0c8'
  - url: 'https://git.kernel.org/stable/c/1474f3970d1afd303e12ff14d06808eabb371576'
  - url: 'https://git.kernel.org/stable/c/07fe270ec07c138a70afe7a81e115a85c35c545c'
  - url: 'https://git.kernel.org/stable/c/fd37f9dd5b5ab70a46fa7bc76623c0528d602b27'
tags:
  - cve.org
epss: 0.0012
epssPercentile: 0.01678
ingestedAt: '2026-10-16T19:46:24.313Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: reject oversized IBs with per-ring packet limits

On GFX rings, amdgpu_cs_p2_ib() passed user-supplied ib_bytes through
to ib->length_dw without a limit, while ring_emit_ib() encodes length
into packet fields. Oversized values can corrupt adjacent control bits
and destabilize command submission.

Add a per-ring IB packet size limit helper and reject command
submissions exceeding the corresponding dword limit before IB
allocation. Use the documented 20-bit limit for GFX/compute/SDMA/VPE,
and apply the MM fallback limit for other ring types.

(cherry picked from commit 7f48fa2cf62e3fa6c9c3870aa74988f773247e52)

## Affected

- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 6e164ba1057175fb8a370d8e05cbff5c57eac0c8`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 1474f3970d1afd303e12ff14d06808eabb371576`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 07fe270ec07c138a70afe7a81e115a85c35c545c`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < fd37f9dd5b5ab70a46fa7bc76623c0528d602b27`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.