CVE-2026-23468: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23468 is a denial-of-service vulnerability in the Linux kernel's drm/amdgpu driver caused by unbounded allocation of Buffer Object (BO) list entries. A local user with low privileges can pass an arbitrarily large value via the bo_number field, triggering excessive memory allocation (potentially gigabytes) and prolonged list processing times. Affected kernel versions span from 4.2 up to (but not including) 6.6.140, 6.7 through 6.12.86, 6.13 through 6.18.20, and 6.19 through 6.19.10, as well as 7.0-rc1 through rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Github Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the drm/amdgpu driver accepted an arbitrary bo_number value from userspace without imposing an upper bound on the number of BO list entries to allocate. While a prior multiplication overflow check prevented out-of-bounds memory writes, it did not prevent a legitimate but enormous allocation request. The fix introduces a hard cap of 131,072 (128k) entries per BO list, returning -EINVAL for requests exceeding this limit; this was cherry-picked from upstream commit 688b87d39e0aa8135105b40dc167d74b5ada5332 (Github Advisory). Exploitation requires only local access and low privileges — no special configuration or user interaction is needed.

Successful exploitation causes memory exhaustion on the affected host, potentially consuming gigabytes of kernel memory and causing the system to become unresponsive or crash, resulting in a denial of service. There is no impact on confidentiality or data integrity; the vulnerability is limited to availability. Systems running AMD GPUs with the amdgpu kernel module loaded are at risk, and the impact is confined to the local system without scope change (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (Github Advisory). The EPSS score is approximately 0.017% (8th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Prerequisite: Obtain a local user account (low-privilege) on a Linux system with an AMD GPU and the amdgpu kernel module loaded.
2. Identify the target interface: Locate the DRM/amdgpu ioctl interface, typically accessible via /dev/dri/cardX or /dev/dri/renderDX device nodes.
3. Craft a malicious BO list request: Construct an ioctl call (e.g., DRM_IOCTL_AMDGPU_BO_LIST_CREATE) with the bo_number field set to an extremely large value (e.g., close to UINT32_MAX) to request allocation of a massive number of BO list entries.
4. Submit the request: Issue the crafted ioctl to the kernel driver. On unpatched kernels, the driver will attempt to allocate memory proportional to the requested entry count, potentially exhausting available system memory.
5. Trigger denial of service: The excessive allocation causes the kernel to consume gigabytes of memory, leading to OOM conditions, system slowdown, or crash, achieving a local denial of service (Github Advisory).

• Logs: Kernel OOM killer messages in /var/log/kern.log or dmesg output referencing amdgpu or DRM subsystem processes being killed due to memory pressure.
• Process: Unusual processes repeatedly opening /dev/dri/cardX or /dev/dri/renderDX and issuing ioctl calls with abnormally large parameters.
• System Metrics: Sudden spike in kernel memory usage (MemAvailable dropping sharply in /proc/meminfo) without a corresponding increase in user-space application memory.
• Kernel Messages: dmesg entries showing -EINVAL returns from amdgpu BO list creation on patched kernels, or allocation failure warnings (alloc_pages failures) on unpatched kernels.

Apply the upstream kernel patch (commit 688b87d39e0aa8135105b40dc167d74b5ada5332) which enforces a 128k entry hard limit on BO lists. Fixed versions include Linux kernel 6.6.140, 6.12.86, 6.18.20, 6.19.10, and 7.0-rc5 or later. Downstream distributions including Debian (linux 6.12.86+1) and SUSE have released updated packages (Github Advisory). As a workaround where patching is not immediately possible, restrict unprivileged user access to DRM device nodes (e.g., via udev rules or group membership controls on /dev/dri/ devices).