Improper input validation in Linux kernel - CVE-2026-53375
Published: July 21, 2026
Vulnerability identifier: #VU138890
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53375
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the amdgpu_vce_cs_reloc function when processing crafted command submission relocation data. A local user can provide invalid lo/hi indices to cause a denial of service.
The issue occurs when only one of the low or high address fields is valid, which can result in a bad address being written in firmware.
How to mitigate CVE-2026-53375
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0ee17150763962671f43a62ddf8f6ea1feaff438
- https://git.kernel.org/stable/c/2d66d1f5d8c0434e9a5ad21cc6eaf3a5e32141d5
- https://git.kernel.org/stable/c/944db9cfa5373f67eb94621d4c2eee572c05fa3f
- https://git.kernel.org/stable/c/b3d1a0a45c4aec484fa2a5b060b611e3d3064470
- https://git.kernel.org/stable/c/de2a02cc28d6d5d37db07d00a9a684c754a5fd74
- https://git.kernel.org/stable/c/ea2c554e700b86a04534b4c24ece5844e8c5f07e