Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-31766

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before com
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:50e8db25da26847d6f5e7c53bb86b5f0c9eb6e351f98ddfac95a6c6f1bc2a41c
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3543005a42d7e8e12b21897ef6798541bf7cbcd3","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"a018d1819f158991b7308e4f74609c6c029b670c","status":"affected","version":"f09c…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3543005a42d7e8e12b21897ef6798541bf7cbcd3","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6","status":"affected","version":"f09c1e6077abd1bc2ddd2b97e1135215801ca7f9","versionType":"git"},{"lessThan":"a018d1819f158991b7308e4f74609c6c029b670c","status":"affected","version":"f09c…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.22","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/metrics/0/cvssV3_1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/3543005a42d7e8e12b21897ef6798541bf7cbcd3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/a018d1819f158991b7308e4f74609c6c029b670c"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:634304fa00ab2061e13281f681f11f0ad762a13eebd6f7e1309e4802e81db806 · sha256:0134dae61f593848… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer