CVE-2026-31766

Root

Cause The vulnerability resides in the amdgpu_userq_get_doorbell_index() function of the AMDGPU kernel driver. When creating a user queue, the driver uses a user-supplied doorbell_offset to calculate an index into the doorbell BAR via amdgpu_doorbell_index_on_bar() without validating the offset against the allocated doorbell buffer object (BO) size. This missing bounds check means an attacker can supply an arbitrarily large offset, causing the computed index to exceed the BO boundary [1][3].

Exploitation

Prerequisites An attacker must have the ability to create a GPU user queue (amdgpu user queue) from userspace, which typically requires local access to the system and the ability to interact with the AMDGPU device driver (e.g., through appropriate device file permissions or via a container/VM with GPU passthrough). The attack leverages the unchecked user-controlled integer to cause the doorbell index to land outside the intended buffer [2].

Impact

By corrupting memory beyond the doorbell BO, the attacker can overwrite kernel doorbell space, which may lead to denial of service (system crash) or potentially privilege escalation, as the doorbell BAR region is used for GPU-to-host notifications. The corruption directly affects kernel memory integrity [1][3].

Mitigation

The patch (cherry-pick commit de1ef4ffd70e) introduces a validation check: it compares the user’s doorbell_offset against the size of the doorbell BO using u64 arithmetic to prevent overflow, and rejects offsets that exceed the bounds. The fix is part of the stable kernel tree and should be applied to affected kernels [2][3].