The Linux kernel's drm/radeon driver contained an integer overflow vulnerability in the radeon_align_pitch() function. Both the alignment round-up addition and the final multiplication ('aligned * cpp') could overflow a signed integer, potentially causing radeon_mode_dumb_create() to return invalid pitch values or create zero-sized dumb buffers. The issue was identified via AST-based call-graph analysis. The patch uses check_add_overflow() and check_mul_overflow() to detect and prevent overflow, returning 0 on overflow and rejecting zero pitch and size in radeon_mode_dumb_create().

If exploited, this vulnerability could cause the creation of invalid or zero-sized dumb buffers in the Radeon DRM driver, which may lead to unexpected behavior or potential denial of service conditions in the graphics subsystem. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this integer overflow vulnerability by adding overflow checks and input validation. Users should apply the official kernel updates that include this patch once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory or Linux kernel mailing lists for the official fix and update guidance.