{"id":"CVE-2026-43400","title":"drm/amdgpu: add upper bound check on user inputs in signal ioctl","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add upper bound check on user inputs in signal ioctl\n\nHuge input values in amdgpu_userq_signal_ioctl can lead to a OOM and\ncould be exploited.\n\nSo check the…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < 6fff5204d8aa26b1be50b6427f833bd3e8899c4f","Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < 46630d966b99b0fc6cb01fef4110587f3375a0c0","Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < ea78f8c68f4f6211c557df49174c54d167821962","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:37:17.931393Z"},"published":"2026-05-08","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:42:51.799Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43400","references":[{"url":"https://git.kernel.org/stable/c/6fff5204d8aa26b1be50b6427f833bd3e8899c4f"},{"url":"https://git.kernel.org/stable/c/46630d966b99b0fc6cb01fef4110587f3375a0c0"},{"url":"https://git.kernel.org/stable/c/ea78f8c68f4f6211c557df49174c54d167821962"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02323,"ingestedAt":"2026-11-06T15:54:03.925Z","slug":"CVE-2026-43400","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: add upper bound check on user inputs in signal ioctl\n\nHuge input values in amdgpu_userq_signal_ioctl can lead to a OOM and\ncould be exploited.\n\nSo check these input value against AMDGPU_USERQ_MAX_HANDLES\nwhich is big enough value for genuine use cases and could\npotentially avoid OOM.\n\n(cherry picked from commit be267e15f99bc97cbe202cd556717797cdcf79a5)\n\n## Affected\n\n- `Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < 6fff5204d8aa26b1be50b6427f833bd3e8899c4f`\n- `Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < 46630d966b99b0fc6cb01fef4110587f3375a0c0`\n- `Linux >= a292fdecd72834b3bec380baa5db1e69e7f70679 < ea78f8c68f4f6211c557df49174c54d167821962`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}