CVE-2026-23468

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion Userspace can pass an arbitrary number of BO list entries via the bo_number field. Although the previous multiplication overflow check prevents out-of-bounds allocation, a large number of entries could still cause excessive memory allocation (up to potentially gigabytes) and unnecessarily long list processing times. Introduce a hard limit of 128k entries per BO list, which is more than sufficient for any realistic use case (e.g., a single list containing all buffers in a large scene). This prevents memory exhaustion attacks and ensures predictable performance. Return -EINVAL if the requested entry count exceeds the limit (cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a	Patch
https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614	Patch
https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd	Patch
https://git.kernel.org/stable/c/c833d6c7199c5b5fca9ec95593acd539ec9c171c
https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288	Patch
https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

History

No history.

Information

Published : 2026-04-03 16:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-23468

Mitre link : CVE-2026-23468

CVE.ORG link : CVE-2026-23468

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-23468", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "c833d6c7199c5b5fca9ec95593acd539ec9c171c", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "e620378aab78d415bd8a15a2f91c145906520288", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "2723e6851309531ce61aed74e93a0cd268cc862a", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "5ce4a38e6c2488949e373d5066303f9c128db614", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9", "versionType": "git"}, {"status": "affected", "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21", "lessThan": "6270b1a5dab94665d7adce3dc78bc9066ed28bdd", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.2"}, {"status": "unaffected", "version": "0", "lessThan": "4.2", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.86", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c"], "defaultStatus": "affected"}]}], "published": "2026-04-03T16:16:34.330", "references": [{"url": "https://git.kernel.org/stable/c/2723e6851309531ce61aed74e93a0cd268cc862a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5ce4a38e6c2488949e373d5066303f9c128db614", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6270b1a5dab94665d7adce3dc78bc9066ed28bdd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c833d6c7199c5b5fca9ec95593acd539ec9c171c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e620378aab78d415bd8a15a2f91c145906520288", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f462624a6e4b5f1ec2664c2c53e408b2f4fb53e9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Limit BO list entry count to prevent resource exhaustion\n\nUserspace can pass an arbitrary number of BO list entries via the\nbo_number field. Although the previous multiplication overflow check\nprevents out-of-bounds allocation, a large number of entries could still\ncause excessive memory allocation (up to potentially gigabytes) and\nunnecessarily long list processing times.\n\nIntroduce a hard limit of 128k entries per BO list, which is more than\nsufficient for any realistic use case (e.g., a single list containing all\nbuffers in a large scene). This prevents memory exhaustion attacks and\nensures predictable performance.\n\nReturn -EINVAL if the requested entry count exceeds the limit\n\n(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amdgpu: Limitar el n\u00famero de entradas de la lista BO para prevenir el agotamiento de recursos\n\nEl espacio de usuario puede pasar un n\u00famero arbitrario de entradas de la lista BO a trav\u00e9s del campo bo_number. Aunque la comprobaci\u00f3n previa de desbordamiento de multiplicaci\u00f3n previene la asignaci\u00f3n fuera de l\u00edmites, un gran n\u00famero de entradas a\u00fan podr\u00eda causar una asignaci\u00f3n excesiva de memoria (potencialmente hasta gigabytes) y tiempos de procesamiento de lista innecesariamente largos.\n\nSe introduce un l\u00edmite estricto de 128k entradas por lista BO, lo cual es m\u00e1s que suficiente para cualquier caso de uso realista (por ejemplo, una \u00fanica lista que contenga todos los b\u00faferes en una escena grande). Esto previene ataques de agotamiento de memoria y asegura un rendimiento predecible.\n\nDevolver -EINVAL si el n\u00famero de entradas solicitado excede el l\u00edmite\n\n(cherry picked from commit 688b87d39e0aa8135105b40dc167d74b5ada5332)"}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51C70DBB-3DC0-42D5-8319-BBAA828267C9", "versionEndExcluding": "6.6.140", "versionStartIncluding": "4.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789", "versionEndExcluding": "6.12.86", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5571059-6552-48E7-9BEF-3E358C387171", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}