CVE-2024-26660

What it actually does

Missing bounds check on eng_id index allows out-of-bounds access to the four-element stream_enc_regs array in dcn301_stream_encoder_create, causing buffer overflow and potential kernel memory corruption.

Why it matters to the business

Risk of system crashes, instability, or local privilege escalation on Linux systems using AMD DCN301 display hardware; low likelihood of exploitation and no known active campaigns reduce operational urgency.

How an attack unfolds

An attacker with local access on an affected kernel triggers the AMD display resource initialization code path that passes an invalid eng_id value of 5 to dcn301_stream_encoder_create, resulting in an out-of-bounds array access that can be leveraged for memory corruption.

How to fix it

Update the Linux kernel to the fixed commit 42442f74314d41ddc68227047036fa3e78940054 or any later stable release that adds the required bounds check before indexing stream_enc_regs.

How to confirm the fix worked

Confirm the running kernel source or binary contains the bounds check on eng_id (index <= 3) in dcn301_resource.c around line 1011; test display initialization on DCN301 hardware after patching.

Typical attack path

1. Gain local user access to a Linux system running an unpatched kernel with AMD DCN301 hardware
2. Trigger display stream encoder creation via graphics configuration or driver initialization that supplies eng_id=5
3. Exploit the resulting buffer overflow to corrupt kernel memory and escalate privileges or cause denial of service

How to detect it

Search kernel logs, dmesg output, and crash dumps for error messages or stack traces mentioning dcn301_stream_encoder_create, stream_enc_regs, or buffer overflow at the reported location.

What your security team should do

• Apply the referenced kernel commit or distribution backport immediately on all systems with AMD DCN301 GPUs
• Review and restrict unnecessary local access to graphics subsystems
• Monitor kernel logs for oops/panic entries referencing dcn301_stream_encoder_create