GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel DRM GEM framebuffer helper: integer wrap lets an undersized buffer pass the size guard

CVSS 7.8CVE-2026-46209NVIDIA / GPU stackcurated

Impact

drm_gem_fb_init_with_funcs() computed sub-sampled plane dimensions with plain integer division while the ioctl-level framebuffer_check() rounded up with DIV_ROUND_UP. For formats like NV12 with a one-pixel-tall framebuffer the helper sees height 0, (height - 1) wraps to UINT_MAX, min_size overflows back to a small value, and a tiny GEM object passes the size guard. The GPU then reads and writes past the end of that object when it touches the chroma plane - an out-of-bounds access driven by hardware, not by the CPU, which makes it a poor fit for the usual containment. This lives in shared DRM core rather than one vendor's driver, but reaching it needs the KMS framebuffer path: headless accelerator nodes that expose only render nodes and no display controller generally cannot get here, and NVIDIA's proprietary datacenter stack does not use these helpers at all. Check whether your nodes expose /dev/dri/card* with a working display pipeline before treating this as urgent.

Who can reach it

Local, authenticated. A user or container with access to a KMS-capable DRM device that can issue ADDFB2 with a sub-sampled format such as NV12 and a degenerate height. Not reachable over the network, and not reachable where no display pipeline is exposed.

What to do

Take the fixed stable kernel and reboot. The fix is a contained one - replace the open-coded divisions with drm_format_info_plane_width/height() - so distribution backports should land quickly. Where nodes are genuinely headless, confirm that no KMS device is handed to tenants and schedule this with the next routine kernel reboot rather than opening a window for it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46209https://git.kernel.org/stable/c/11427ad6c9f0def5ce567982b785da3191946430https://git.kernel.org/stable/c/1a17ea9861e89585361caa8bc231bd22dc6dbe7dhttps://git.kernel.org/stable/c/1da4ab7189f1064b3b712b388772c008b4d82580

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.