SB2026072166 - Improper input validation in Linux kernel amd amdgpu driver
Published: July 21, 2026
Security Bulletin ID
SB2026072166
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper input validation (CVE-ID: CVE-2026-53375)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the amdgpu_vce_cs_reloc function when processing crafted command submission relocation data. A local user can provide invalid lo/hi indices to cause a denial of service.
The issue occurs when only one of the low or high address fields is valid, which can result in a bad address being written in firmware.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/0ee17150763962671f43a62ddf8f6ea1feaff438
- https://git.kernel.org/stable/c/2d66d1f5d8c0434e9a5ad21cc6eaf3a5e32141d5
- https://git.kernel.org/stable/c/944db9cfa5373f67eb94621d4c2eee572c05fa3f
- https://git.kernel.org/stable/c/b3d1a0a45c4aec484fa2a5b060b611e3d3064470
- https://git.kernel.org/stable/c/de2a02cc28d6d5d37db07d00a9a684c754a5fd74
- https://git.kernel.org/stable/c/ea2c554e700b86a04534b4c24ece5844e8c5f07e