Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets The VCPU BO contains the… (CVE-2026-64516)
Affects linux-hwe-edgeSource GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| linux-hwe-edge | Affected
| Fixed in– |
AI-suggested
A patch is available and should be applied promptly. The vendor advisory from Ubuntu confirms fixes are included in Linux kernel versions 7.0.0-28.28~24.04.1 and later, among others. Users should update to the fixed kernel versions listed in the advisory and reboot systems to apply changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation steps are indicated beyond applying the official updates.
Description
A vulnerability in the Linux kernel's drm/amdgpu/vce1 subsystem related to incorrect calculation of firmware size and offsets has been resolved. The issue involved the VCPU buffer object (BO) not properly accounting for firmware offset, potentially leading to out-of-bounds access. The fix ensures correct size calculation and alignment to the 32K TLB size. This vulnerability is addressed in multiple Linux kernel versions with patches available. The CVSS score is 8.8, indicating a high severity vulnerability with potential for privilege escalation and system compromise.
Impact
Successful exploitation could allow a local attacker with low privileges to cause out-of-bounds memory access in the AMD GPU driver, potentially leading to privilege escalation and full system compromise. The vulnerability affects confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported. The vulnerability is part of a larger set of kernel issues that could be leveraged to compromise affected systems.
Summary
The Linux kernel vulnerability CVE-2026-64516 in the drm/amdgpu/vce1 driver was caused by improper calculation of the VCPU BO size due to not including the firmware offset. This could lead to out-of-bounds memory access. The fix subtracts the firmware offset from the firmware size to prevent such access and aligns stack and data offsets to the 32K TLB size. The update ensures the firmware microcode fits within the reserved space. This vulnerability is part of a broader set of Linux kernel security fixes addressing multiple subsystems. The vulnerability has a CVSS 3.1 score of 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in high impact on confidentiality, integrity, and availability.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64516 (opens in a new tab)
- git.kernel.org/stable/c/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 (opens in a new tab)
- git.kernel.org/stable/c/ce0de178ef08408f6ba8f2e9a13bf52fbe5852f4 (opens in a new tab)
- ubuntu.com/security/CVE-2026-64516 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-64516 (opens in a new tab)
- git.kernel.org/linus/3e5a1d5bb2ff061e64c7992f8e5404dfd4c2d0f3 (opens in a new tab)
- ubuntu.com/security/notices/USN-8618-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8663-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8664-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8728-1 (opens in a new tab)