CVE-2026-23468

In the Linux kernel's drm/amdgpu driver, the BO list handling lacked a limit on the number of entries userspace could specify via the bo_number field. While a previous multiplication overflow check prevented out-of-bounds memory access, an attacker could still request an arbitrarily large number of entries, leading to excessive memory allocation (potentially gigabytes) and prolonged list processing times. This vulnerability is addressed by introducing a hard limit of 128k entries per BO list, which is sufficient for all realistic use cases [1][2][3][4].

An unprivileged user with access to the amdgpu device can exploit this by submitting a BO list with a very large entry count. No authentication beyond device access is required, and the attack can be performed from userspace. The kernel would then allocate memory proportional to the requested number of entries and spend significant CPU time processing the list, effectively enabling a denial-of-service condition.

The impact is resource exhaustion, leading to system instability, memory pressure, or a complete denial of service for other processes. The attacker does not gain code execution or privilege escalation, but can render the system unresponsive.

The fix has been applied to the Linux kernel stable branches, as seen in commits [1][2][3][4]. Systems running an updated kernel are no longer vulnerable. No workaround is available; users should apply the kernel update.