CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject oversized IBs with per-ring packet limits On GFX rings, amdgpucsp2ib passed user-supplied ibbytes through to ib-lengthdw without a limit, while ringemitib encodes length into packet fields. Oversized values can...

CVE-2026-80576

CVE-2026-80576 affects the Linux kernel's drm/amdgpu driver. In amdgpu_cs_p2_ib(), a user-supplied ib_bytes value was passed to ib->length_dw without a limit. Since ring_emit_ib() encodes this length into packet fields, oversized values can corrupt adjacent control bits , destabilizing command...