Out-of-bounds read in Linux kernel - CVE-2026-64516
Published: July 27, 2026
Vulnerability identifier: #VU139425
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-64516
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds access in the amdgpu VCE 1 firmware loading and memory cache setup code when processing firmware microcode and calculating buffer offsets and sizes. A local user can provide specially crafted firmware data to trigger an out-of-bounds access and cause a denial of service.
The issue involves incorrect accounting for the firmware offset within the VCPU buffer object and improper alignment and bounds validation for reserved firmware, stack, and data regions.
How to mitigate CVE-2026-64516
Install security update from vendor's repository.