CVE-2026-23468 (GCVE-0-2026-23468)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-06-01 16:11
VLAI
Title
drm/amdgpu: Limit BO list entry count to prevent resource exhaustion
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < c833d6c7199c5b5fca9ec95593acd539ec9c171c (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < e620378aab78d415bd8a15a2f91c145906520288 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 2723e6851309531ce61aed74e93a0cd268cc862a (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 5ce4a38e6c2488949e373d5066303f9c128db614 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9 (git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 6270b1a5dab94665d7adce3dc78bc9066ed28bdd (git)
Create a notification for this product.
Linux Linux Affected: 4.2
Unaffected: 0 , < 4.2 (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.140 , ≤ 6.6.* (semver)
Unaffected: 6.12.86 , ≤ 6.12.* (semver)
Unaffected: 6.18.20 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c833d6c7199c5b5fca9ec95593acd539ec9c171c",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "e620378aab78d415bd8a15a2f91c145906520288",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "2723e6851309531ce61aed74e93a0cd268cc862a",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "5ce4a38e6c2488949e373d5066303f9c128db614",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "6270b1a5dab94665d7adce3dc78bc9066ed28bdd",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Limit BO list entry count to prevent resource exhaustion\n\nUserspace can pass an arbitrary number of BO list entries via the\nbo_number field. Although the previous multiplication overflow check\nprevents out-of-bounds allocation, a large number of entries could still\ncause excessive memory allocation (up to potentially gigabytes) and\nunnecessarily long list processing times.\n\nIntroduce a hard limit of 128k entries per BO list, which is more than\nsufficient for any realistic use case (e.g., a single list containing all\nbuffers in a large scene). This prevents memory exhaustion attacks and\nensures predictable performance.\n\nReturn -EINVAL if the requested entry count exceeds the limit\n\n(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:11:15.659Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c833d6c7199c5b5fca9ec95593acd539ec9c171c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288"
        },
        {
          "url": "https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614"
        },
        {
          "url": "https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd"
        }
      ],
      "title": "drm/amdgpu: Limit BO list entry count to prevent resource exhaustion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23468",
    "datePublished": "2026-04-03T15:15:47.207Z",
    "dateReserved": "2026-01-13T15:37:46.021Z",
    "dateUpdated": "2026-06-01T16:11:15.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23468",
      "date": "2026-07-26",
      "epss": "0.00123",
      "percentile": "0.02474"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-09T14:39:35.000Z",
      "cve": "CVE-2026-23468",
      "id": "msrc_CVE-2026-23468",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu: Limit BO list entry count to prevent resource exhaustion",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23468.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23468\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:34.330\",\"lastModified\":\"2026-07-24T22:10:00.140\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amdgpu: Limit BO list entry count to prevent resource exhaustion\\n\\nUserspace can pass an arbitrary number of BO list entries via the\\nbo_number field. Although the previous multiplication overflow check\\nprevents out-of-bounds allocation, a large number of entries could still\\ncause excessive memory allocation (up to potentially gigabytes) and\\nunnecessarily long list processing times.\\n\\nIntroduce a hard limit of 128k entries per BO list, which is more than\\nsufficient for any realistic use case (e.g., a single list containing all\\nbuffers in a large scene). This prevents memory exhaustion attacks and\\nensures predictable performance.\\n\\nReturn -EINVAL if the requested entry count exceeds the limit\\n\\n(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndrm/amdgpu: Limitar el n\u00famero de entradas de la lista BO para prevenir el agotamiento de recursos\\n\\nEl espacio de usuario puede pasar un n\u00famero arbitrario de entradas de la lista BO a trav\u00e9s del campo bo_number. Aunque la comprobaci\u00f3n previa de desbordamiento de multiplicaci\u00f3n previene la asignaci\u00f3n fuera de l\u00edmites, un gran n\u00famero de entradas a\u00fan podr\u00eda causar una asignaci\u00f3n excesiva de memoria (potencialmente hasta gigabytes) y tiempos de procesamiento de lista innecesariamente largos.\\n\\nSe introduce un l\u00edmite estricto de 128k entradas por lista BO, lo cual es m\u00e1s que suficiente para cualquier caso de uso realista (por ejemplo, una \u00fanica lista que contenga todos los b\u00faferes en una escena grande). Esto previene ataques de agotamiento de memoria y asegura un rendimiento predecible.\\n\\nDevolver -EINVAL si el n\u00famero de entradas solicitado excede el l\u00edmite\\n\\n(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"c833d6c7199c5b5fca9ec95593acd539ec9c171c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"e620378aab78d415bd8a15a2f91c145906520288\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"2723e6851309531ce61aed74e93a0cd268cc862a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"5ce4a38e6c2488949e373d5066303f9c128db614\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d38ceaf99ed015f2a0b9af3499791bd3a3daae21\",\"lessThan\":\"6270b1a5dab94665d7adce3dc78bc9066ed28bdd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.86\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.20\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.10\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"51C70DBB-3DC0-42D5-8319-BBAA828267C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"55DA1C62-9991-451E-B8A8-E0004E00F789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.20\",\"matchCriteriaId\":\"E5571059-6552-48E7-9BEF-3E358C387171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.10\",\"matchCriteriaId\":\"96D34333-38BE-4414-9E79-6EB764329581\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c833d6c7199c5b5fca9ec95593acd539ec9c171c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:16:13+00:00",
      "cve": "CVE-2026-23468",
      "id": "CVE-2026-23468",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23468.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:42:10Z",
      "cve": "CVE-2026-23468",
      "id": "CVE-2026-23468",
      "initial_release_date": "2026-04-03T23:27:06Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "210",
      "product_status:known_not_affected": "4",
      "product_status:recommended": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23468",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23468.json",
      "version": "17"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.