CVE-2026-89818
HIGH
Published Sep 16, 2026
Modified Sep 16, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression 6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting the parser loop far past the end of the message BO. Triggering it additionally requires a ~4GiB mapping so that msg[1] survives the earlier "header does not fit in BO" check. Rewrite the test in division form, which is overflow-free by construction. Also update the message to reflect that msg is invalid.
Is your site exposed to CVE-2026-89818?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
7.1
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
Other References
https://git.kernel.org/stable/c/47799e1f893d47d8af231710a61065e3ec8a13e8
https://git.kernel.org/stable/c/4d7390530853eb7befda9cc786e4c86e8ad7ac9e
https://git.kernel.org/stable/c/6dceaeceaa7c8396339f3ea34b0110cb912ca61b
https://git.kernel.org/stable/c/7e28853c78c20bb8ba4c1dba702430cd05e09f76
https://git.kernel.org/stable/c/9ae19bd60891bea0a7b7504cc8dbfe74570ac3b3
https://git.kernel.org/stable/c/c2340281be4ddacb8c203e2bce59b126d1d6c4c8
Frequently Asked Questions
What is CVE-2026-89818? +
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check
If the supplied msg[2] (num_buffers) is 0x3FFFFFFF, the expression
6 + num_buffers * 4 wraps to 2 and the bounds check passes, letting
the parser loop far past the end of the message BO. Triggering it
additionally requires a ~4GiB mapping so that msg[1] survives the
earlier "header does not fit in BO" check.
Rewrite the test in division form, which is overflow-free by
construction. Also update the message to reflect that msg is invalid. It has a CVSS v3.1 base score of 7.1 (HIGH).
How severe is CVE-2026-89818? +
CVE-2026-89818 has a CVSS v3.1 score of 7.1 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
How do I check if I'm vulnerable to CVE-2026-89818? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.