https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 11:35:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-89818 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check</p> <p>If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier &#34;header does not fit in BO&#34; check.</p> <p>Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check</p> <p>If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier &#34;header does not fit in BO&#34; check.</p> <p>Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.</p> https://vulnerability.circl.lu/vuln/cve-2026-89818