CVE-2026-74417
Description
A flaw was found in the Linux kernel's drm/radeon component. An integer overflow vulnerability exists in the radeon_align_pitch() function. This flaw occurs when calculating memory alignment and pitch, where large values can cause the calculations to wrap around. If exploited, this could lead to the creation of an invalid pitch or a zero-sized buffer, potentially resulting in a Denial of Service (DoS) condition for the system.
Statement
An integer overflow in the DRM/Radeon dumb buffer creation path can occur in radeon_align_pitch when rounding up the pitch or multiplying the aligned value by bytes per pixel. A local process with access to the Radeon DRM device can request crafted width and bpp values that make the helper return an invalid pitch or zero, which can lead to an invalid or zero sized GEM dumb buffer. For the CVSS the PR:L is used because reliable triggering requires local access to the DRM device node, often through a logged in user session or video/render device permissions. The issue is not network reachable. Impact is at least local denial of service through invalid graphics buffer state or driver failure.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
