CVE-2026-80576

This vulnerability affects the Linux kernel drm/amdgpu driver. In the GFX ring path, amdgpu_cs_p2_indirect_buffer() passed a user-supplied ib_bytes value to ib->length_dw without enforcing a size limit. Because ring_emit_ib() encodes that length into fixed-width packet fields, oversized values...