CVE-2026-68276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

The cleaner shader sysfs path allocates a 16-dword (64 byte) IB but

incorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is

0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a

kernel page fault.

The IB only needs to be a minimal NOP shell to schedule the job; the

cleaner shader itself is emitted on the ring via emit_cleaner_shader().

Fill 16 dwords to match the allocation.

v2: Use ib_size_dw variable (Lijo)

(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References