GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel amdgpu: unvalidated plane degamma LUT size allows divide-by-zero or out-of-bounds read

CVSS 7.8CVE-2026-89819NVIDIA / GPU stackcurated

Impact

A local process with access to the DRM device can set the per-plane AMD_PLANE_DEGAMMA_LUT property with a malformed blob (for example a single entry). The size was never validated, so __is_lut_linear() can divide by zero and __drm_lut_to_dc_gamma() iterates MAX_COLOR_LUT_ENTRIES regardless of the real LUT length, reading out of bounds. On a GPU compute node this is a local crash or kernel memory disclosure vector, not remote. Exposure is narrow: the property only exists on kernels built with AMD_PRIVATE_COLOR, and the display path is generally not present or not reachable on headless MI-series accelerators, so most AMD datacenter fleets are unaffected. Where amdgpu display is compiled in and the DRM node is exposed to tenants, it is a node-availability risk.

Who can reach it

Local user with an open handle on the amdgpu DRM device (a container with /dev/dri passed through counts). Requires a kernel built with AMD_PRIVATE_COLOR. No remote path.

What to do

Pick up the stable kernel containing the fix (four stable commits are referenced) and reboot each affected node - a kernel change on a GPU node means draining the workloads and rebooting, so batch it with the next maintenance window unless tenants hold DRM device access. Interim mitigation: do not pass /dev/dri into untrusted containers on AMD display-enabled kernels. No fixed release version is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-89819https://git.kernel.org/stable/c/0b2615b8b54f58bbdf986dffb38cbc35214a5cc5https://git.kernel.org/stable/c/e4c3ab59021e7c146a84b6671f0d530972bd58b4https://git.kernel.org/stable/c/f6f04d8ae5725bcc893bdc62e3467efd97255c5b

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.