Answer in brief
CVE-2026-68108 records a High severity (CVSS 8.8) vulnerability in drm/amdgpu/vce: fix integer overflow in image size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a07430abd556de3707adfcadcc60db3fa64e4b2b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a6d7065b91a14790980ce6f4960db0ca8c3c9940 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7eebef042c12dfe0568593ee6a8926d16505925e || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <00c311a13d225266800c712f2b7db2711c6897de || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <186bfdc4e26d019b2e7570cb121964a1d89b2e5b || >=0 <6.6.148 || >=0 <6.12.101 || >=0 <6.18.42 || >=0 <7.1.6 | a07430abd556de3707adfcadcc60db3fa64e4b2b, a6d7065b91a14790980ce6f4960db0ca8c3c9940, 7eebef042c12dfe0568593ee6a8926d16505925e, 00c311a13d225266800c712f2b7db2711c6897de, 186bfdc4e26d019b2e7570cb121964a1d89b2e5b, 6.6.148, 6.12.101, 6.18.42, 7.1.6 |
| Linux/Linuxgeneric | >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <a07430abd556de3707adfcadcc60db3fa64e4b2b || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <a6d7065b91a14790980ce6f4960db0ca8c3c9940 || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <7eebef042c12dfe0568593ee6a8926d16505925e || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <00c311a13d225266800c712f2b7db2711c6897de || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <186bfdc4e26d019b2e7570cb121964a1d89b2e5b | a07430abd556de3707adfcadcc60db3fa64e4b2b, a6d7065b91a14790980ce6f4960db0ca8c3c9940, 7eebef042c12dfe0568593ee6a8926d16505925e, 00c311a13d225266800c712f2b7db2711c6897de, 186bfdc4e26d019b2e7570cb121964a1d89b2e5b |
| Linux/Linuxgeneric | 4.2 | Not reported |
| Linux/Linuxgeneric | >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <893db20383800cfe92e638705984eebb13bc81a5 || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <a07430abd556de3707adfcadcc60db3fa64e4b2b || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <a6d7065b91a14790980ce6f4960db0ca8c3c9940 || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <7eebef042c12dfe0568593ee6a8926d16505925e || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <00c311a13d225266800c712f2b7db2711c6897de || >=f1689ec1b0b1256d0e69653cd4aaeee44aafdf5c <186bfdc4e26d019b2e7570cb121964a1d89b2e5b | 893db20383800cfe92e638705984eebb13bc81a5, a07430abd556de3707adfcadcc60db3fa64e4b2b, a6d7065b91a14790980ce6f4960db0ca8c3c9940, 7eebef042c12dfe0568593ee6a8926d16505925e, 00c311a13d225266800c712f2b7db2711c6897de, 186bfdc4e26d019b2e7570cb121964a1d89b2e5b |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow, wrapping the calculated buffer size to 0. This bypasses validation and allows GPU firmware to perform out-of-bound memory access. The fix uses 64-bit arithmetic to detect overflow and rejects invalid dimensions before they reach the hardware. V2: remove redundant check V3: modify max height value V4: remove size64 (cherry picked from commit cbe408dba581755ad1279a487ec786d8927d778d)
Quoted source text, attributed separately from HOL analysis.