Cloudanix VulnDB

CVE-2026-68276

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A programming mistake in the AMD graphics driver can cause the Linux kernel to write too much data into a small memory area, crashing the whole computer when certain graphics controls are used.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write due to incorrect loop bounds when populating a 16-dword IB buffer allocated for the cleaner shader sysfs path; the code used (align_mask + 1) dwords instead of the allocated size, writing 256 dwords on GFX rings and triggering a kernel page fault.

Why it matters to the business

Kernel crashes or denial of service on Linux systems with AMD GPUs when the affected sysfs interface is exercised, reducing system availability and requiring reboots.

How an attack unfolds

An attacker with sufficient privileges to access the AMDGPU sysfs cleaner shader path triggers allocation and population of the undersized IB; the oversized write overflows the buffer, faults a kernel page, and crashes the system.

How to fix it

Apply the upstream fix that changes the fill loop to use a 16-dword ib_size_dw variable matching the allocation; update to a kernel containing commit bf21af331ebf72d0935fd70c73192414a422c03a or later.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit or the corrected ib_size_dw logic; attempt to exercise the cleaner shader sysfs path and verify no page fault occurs.

Typical attack path

  1. Identify a Linux host with an AMD GPU and loadable amdgpu driver
  2. Locate the cleaner shader sysfs entry under the DRM device
  3. Write or read the entry to invoke the IB allocation and fill routine
  4. Trigger the oversized dword write that overflows the 64-byte buffer
  5. Cause kernel page fault and system instability or crash

How to detect it

Search kernel logs and dmesg for page faults or oops messages referencing amdgpu, gfx, cleaner shader, or IB buffer operations around the time of unexpected reboots or hangs.

What your security team should do

  • Prioritize kernel updates containing the cleaner shader IB size fix on all AMD GPU hosts
  • Restrict unprivileged access to DRM sysfs entries until patched
  • Monitor kernel logs for amdgpu-related page faults during normal operation

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is 0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a kernel page fault. The IB only needs to be a minimal NOP shell to schedule the job; the cleaner shader itself is emitted on the ring via emit_cleaner_shader(). Fill 16 dwords to match the allocation. v2: Use ib_size_dw variable (Lijo) (cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)

Affected packages

Ecosystem Package Introduced Fixed