{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74417", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.893Z", "datePublished": "2026-08-15T05:59:22.731Z", "dateUpdated": "2026-08-17T05:46:58.637Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:58.637Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n'aligned * cpp' calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only via DRM_IOCTL_MODE_CREATE_DUMB on a local primary DRM device node (/dev/dri/card*); radeon_drm_ioctl() dispatches to radeon_mode_dumb_create() -> radeon_align_pitch(), with no network, Bluetooth, or remote packet path to this legacy radeon KMS driver.\nAC:L - An attacker fully controls width, height, and bpp in the ioctl and can pick values (e.g. width=0x3FFFFFC0, bpp=32) that pass generic drm_mode_create_dumb() checks yet wrap signed-int pitch math, deterministically yielding zero or invalid pitch without races or uncontrollable layout.\nPR:L - Exploitation requires opening the primary DRM node (render clients are blocked because CREATE_DUMB lacks DRM_RENDER_ALLOW); typical access is via the video group or logind session ACLs, i.e. a low-privileged local account, not root/CAP_SYS_ADMIN in the init namespace.\nUI:N - The attacker triggers the overflow from their own process by issuing CREATE_DUMB with crafted dimensions; no victim must mount filesystems, click links, or perform any separate action.\nS:U - Impact is in-kernel GEM/TTM memory corruption and privilege escalation within the host kernel security boundary, not a KVM guest-to-host escape, IOMMU bypass, or other cross-authority scope change.\nC:H - Signed-int overflow can return pitch 0 or a bogus u32 pitch while drm_mode_create_dumb() already validated a much larger stride, creating undersized VRAM/GTT GEM objects whose metadata mismatches actual backing, enabling out-of-bounds kernel reads of adjacent allocations.\nI:H - A zero-sized or undersized dumb buffer paired with attacker-chosen width/height lets subsequent mmap, map_dumb, and GPU scanout paths treat the object as larger than allocated, corrupting adjacent kernel heap/VRAM objects and enabling control-flow hijack primitives.\nA:H - Pre-fix code allocates zero-byte GEM objects on overflow instead of failing cleanly, and malformed pitch/size metadata can provoke kernel oopses, GPU faults, or repeatable denial of service when the BO is mapped or used for display."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/radeon/radeon_gem.c"], "versions": [{"version": "ff72145badb834e8051719ea66e024784d000cb4", "lessThan": "b7b44937c548c2c987fcdd129f8896741004bed6", "status": "affected", "versionType": "git"}, {"version": "ff72145badb834e8051719ea66e024784d000cb4", "lessThan": "415bb9893e249e46aa5159f7363a11512cf06fa9", "status": "affected", "versionType": "git"}, {"version": "ff72145badb834e8051719ea66e024784d000cb4", "lessThan": "d9dfa176899d488e48bb7342d2c43ddd36e66318", "status": "affected", "versionType": "git"}, {"version": "ff72145badb834e8051719ea66e024784d000cb4", "lessThan": "dfc7b5b5599472277e71e5bd2712740651c7c5be", "status": "affected", "versionType": "git"}, {"version": "ff72145badb834e8051719ea66e024784d000cb4", "lessThan": "ce3b24eb3ee8f82de851535f516bf21f83e82259", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/radeon/radeon_gem.c"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6"}, {"url": "https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9"}, {"url": "https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318"}, {"url": "https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be"}, {"url": "https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259"}], "title": "drm/radeon: fix integer overflow in radeon_align_pitch()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/radeon/radeon_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b7b44937c548c2c987fcdd129f8896741004bed6", "status": "affected", "version": "ff72145badb834e8051719ea66e024784d000cb4", "versionType": "git"}, {"lessThan": "415bb9893e249e46aa5159f7363a11512cf06fa9", "status": "affected", "version": "ff72145badb834e8051719ea66e024784d000cb4", "versionType": "git"}, {"lessThan": "d9dfa176899d488e48bb7342d2c43ddd36e66318", "status": "affected", "version": "ff72145badb834e8051719ea66e024784d000cb4", "versionType": "git"}, {"lessThan": "dfc7b5b5599472277e71e5bd2712740651c7c5be", "status": "affected", "version": "ff72145badb834e8051719ea66e024784d000cb4", "versionType": "git"}, {"lessThan": "ce3b24eb3ee8f82de851535f516bf21f83e82259", "status": "affected", "version": "ff72145badb834e8051719ea66e024784d000cb4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/radeon/radeon_gem.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.39"}, {"lessThan": "2.6.39", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix integer overflow in radeon_align_pitch()\n\nradeon_align_pitch() has the same kind of overflow issue as the old\namdgpu helper: both the alignment round-up add and the final\n'aligned * cpp' calculation can overflow signed int.\n\nIf that wraps, radeon_mode_dumb_create() can end up returning an\ninvalid pitch or creating a zero-sized dumb buffer.\n\nFix this by using check_add_overflow() for the alignment round-up and\ncheck_mul_overflow() for the final pitch calculation, returning 0 on\noverflow. Also reject zero pitch and size in\nradeon_mode_dumb_create().\n\nFound via AST-based call-graph analysis using sqry."}], "id": "CVE-2026-74417", "lastModified": "2026-08-17T06:19:37.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:43.807", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/radeon: fix integer overflow in radeon_align_pitch()", "id": "2516866", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516866"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["A flaw was found in the Linux kernel's drm/radeon component. An integer overflow vulnerability exists in the `radeon_align_pitch()` function. This flaw occurs when calculating memory alignment and pitch, where large values can cause the calculations to wrap around. If exploited, this could lead to the creation of an invalid pitch or a zero-sized buffer, potentially resulting in a Denial of Service (DoS) condition for the system."], "name": "CVE-2026-74417", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74417\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74417\nhttps://lore.kernel.org/linux-cve-announce/2026081512-CVE-2026-74417-ee3c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff72145badb834e8051719ea66e024784d000cb4,b7b44937c548c2c987fcdd129f8896741004bed6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff72145badb834e8051719ea66e024784d000cb4,415bb9893e249e46aa5159f7363a11512cf06fa9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff72145badb834e8051719ea66e024784d000cb4,d9dfa176899d488e48bb7342d2c43ddd36e66318)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff72145badb834e8051719ea66e024784d000cb4,dfc7b5b5599472277e71e5bd2712740651c7c5be)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ff72145badb834e8051719ea66e024784d000cb4,ce3b24eb3ee8f82de851535f516bf21f83e82259)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.39"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.39)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T16:15:03.533181+00:00", "updated": "2026-08-17T14:45:04.257985+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-190"]}