From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEB0138836E for ; Sat, 15 Aug 2026 06:41:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786776066; cv=none; b=nuPxkx+e34EsUJ05YQ4GMRpmHkDOG/Wq7RwWZIHdHw7JiKWnIBzcj+49oxVDz6i7D3nOd9fn4jseukIP+YSRtdrw9q1dWodpHETs4UT8rxlPnwgdfKFIWhpBBNv0rGXANw8aMucubebMa+Qd9fvy8N4mTy77sRECwlFsKsrO1ec= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786776066; c=relaxed/simple; bh=Rri+wXxPCrfmlya07sOJbIvbYsbgMTj9vpOT6rax8Uo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LrVcTgYynNTNy75SiIFRhMvulXgaJk7QQ5IVqC4zfkfMmYxzEX+SMgXvXMr0JZplnO/rblrMUCuSBTOWQX6Vc5IjjwkZ9pea5bJggTU+b9Uo6SUb5VTvUaaTyMoA9tQUdXi+dNk2ABHS3tYd1iYlDhS9vruOx17FRJI9+R7dmTk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2WL5S5zI; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2WL5S5zI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51DAA1F000E9; Sat, 15 Aug 2026 06:41:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786776064; bh=cP8EFswjvGr8HW6Bhhe/qy0a5qpOBZ9qhXQCNHjVXAk=; h=From:To:Cc:Subject:Date:Reply-To; b=2WL5S5zI9VFPkICmsxnGFWgM0Ak3JRky+B6zhPpSxHwrA7JWGiYgeTpE+v0lgN+lZ +sPmM3Ubba0XgC/DxtkjYi8jV8CFOEcgHVpYTX/+0BAm0sDvcSQsDB1kMZCaP1u51d hgG7F+Sg8jYgrauL9vXUJm9N1/uyklAI8CMsD6Rc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74417: drm/radeon: fix integer overflow in radeon_align_pitch() Date: Sat, 15 Aug 2026 15:12:24 +0900 Message-ID: <2026081512-CVE-2026-74417-ee3c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3050; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=dPmQ6c068yaz7O7/6d1PrVMV0AhwOMHolVlo9mAglUU=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNjAoqUu+qxMpUGI99O+EufNJg04lLon+Vr26fXvLic LnQimMlHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR2vsMCxaqMVUvuLDyRNXE GfcfOZjWy8cvmMKwYIfMyvVb+D9aeVlatZafO3lLQV31JwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix integer overflow in radeon_align_pitch() radeon_align_pitch() has the same kind of overflow issue as the old amdgpu helper: both the alignment round-up add and the final 'aligned * cpp' calculation can overflow signed int. If that wraps, radeon_mode_dumb_create() can end up returning an invalid pitch or creating a zero-sized dumb buffer. Fix this by using check_add_overflow() for the alignment round-up and check_mul_overflow() for the final pitch calculation, returning 0 on overflow. Also reject zero pitch and size in radeon_mode_dumb_create(). Found via AST-based call-graph analysis using sqry. The Linux kernel CVE team has assigned CVE-2026-74417 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.39 with commit ff72145badb834e8051719ea66e024784d000cb4 and fixed in 6.6.145 with commit b7b44937c548c2c987fcdd129f8896741004bed6 Issue introduced in 2.6.39 with commit ff72145badb834e8051719ea66e024784d000cb4 and fixed in 6.12.97 with commit 415bb9893e249e46aa5159f7363a11512cf06fa9 Issue introduced in 2.6.39 with commit ff72145badb834e8051719ea66e024784d000cb4 and fixed in 6.18.40 with commit d9dfa176899d488e48bb7342d2c43ddd36e66318 Issue introduced in 2.6.39 with commit ff72145badb834e8051719ea66e024784d000cb4 and fixed in 7.1.5 with commit dfc7b5b5599472277e71e5bd2712740651c7c5be Issue introduced in 2.6.39 with commit ff72145badb834e8051719ea66e024784d000cb4 and fixed in 7.2-rc1 with commit ce3b24eb3ee8f82de851535f516bf21f83e82259 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74417 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/radeon/radeon_gem.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/b7b44937c548c2c987fcdd129f8896741004bed6 https://git.kernel.org/stable/c/415bb9893e249e46aa5159f7363a11512cf06fa9 https://git.kernel.org/stable/c/d9dfa176899d488e48bb7342d2c43ddd36e66318 https://git.kernel.org/stable/c/dfc7b5b5599472277e71e5bd2712740651c7c5be https://git.kernel.org/stable/c/ce3b24eb3ee8f82de851535f516bf21f83e82259