CVE-2026-31766

Published: Mag 01, 2026 Last Modified: Mag 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,1
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: high

Description

AI Translation Available

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: validate doorbell_offset in user queue creation

amdgpu_userq_get_doorbell_index() passes the user-provided
doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds
checking. An arbitrarily large doorbell_offset can cause the
calculated doorbell index to fall outside the allocated doorbell BO,
potentially corrupting kernel doorbell space.

Validate that doorbell_offset falls within the doorbell BO before
computing the BAR index, using u64 arithmetic to prevent overflow.

(cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0001
Percentile
0,0th
Updated

EPSS Score Trend (Last 2 Days)

https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef67…
https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3
https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb…
https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6
https://git.kernel.org/stable/c/a018d1819f158991b7308e4f746…
https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c