CVE-2026-43398: drm/amdgpu: add upper bound check on user inputs in wait ioctl

CVE-2026-43398: drm/amdgpu: add upper bound check on user inputs in wait ioctl

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: add upper bound check on user inputs in wait ioctl

Huge input values in amdgpu_userq_wait_ioctl can lead to a OOM and
could be exploited.

So check these input value against AMDGPU_USERQ_MAX_HANDLES
which is big enough value for genuine use cases and could
potentially avoid OOM.

v2: squash in Srini's fix

(cherry picked from commit fcec012c664247531aed3e662f4280ff804d1476)

The Linux kernel CVE team has assigned CVE-2026-43398 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.18.19 with commit b1d10508da559da2e0ca9cca6505094a7df948e1
	Fixed in 6.19.9 with commit 3cd93bc695b3456f26f5ed52753d9071da26202a
	Fixed in 7.0 with commit 64ac7c09fc44985ec9bb6a9db740899fa40ca613

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-43398
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b1d10508da559da2e0ca9cca6505094a7df948e1
	https://git.kernel.org/stable/c/3cd93bc695b3456f26f5ed52753d9071da26202a
	https://git.kernel.org/stable/c/64ac7c09fc44985ec9bb6a9db740899fa40ca613