Security readout for executives and security teams
Plain-English summary
A flaw in Linux’s AMD GPU driver can let a locally authenticated, low-privilege user trigger memory access outside an expected command buffer. The supplied CVSS assessment indicates possible exposure of sensitive information and system disruption, but no integrity impact. This is primarily a concern for multi-user or workload-hosting systems with affected AMD graphics hardware and drivers.
Executive priority
Treat as a high-priority local privilege-boundary issue, especially on shared Linux systems with AMD GPUs. It does not warrant remote-emergency handling based on current evidence, but confidentiality and availability impacts justify timely patching. Ask infrastructure teams to identify AMDGPU exposure and confirm vendor-fixed kernels rather than relying only on version strings.
Technical view
AMDGPU UVD, VCE, and VCN code accessed indirect buffers at predefined offsets without first confirming sufficient buffer length. The correction adds bounds checks to ib_get_value and ib_set_value and changes the index to uint32_t, preventing overflow from defeating validation. CVSS 3.1 is 7.1: local, low complexity, low privileges, no user interaction, with high confidentiality and availability impact.
Likely exposure
Likely exposure is limited to Linux systems using the AMDGPU driver and relevant UVD, VCE, or VCN paths on affected kernel branches. The supplied affected-version list spans multiple kernel lines but does not clearly express every fixed boundary. Distribution backports may also change exposure, so kernel version alone is insufficient.
Exploitation context
The supplied assessment requires local access and low privileges; it does not describe remote exploitation. CVE-2026-46218 is not listed as KEV in the bundle, and no supplied source reports active exploitation or a public exploit. Practical exploitability and prerequisites beyond the affected driver paths remain unconfirmed.
Researcher notes
Review the UVD, VCE, and VCN call paths reaching ib_get_value and ib_set_value, including caller handling of arbitrary return values. The source identifies missing bounds checks and index-overflow hardening but provides no demonstrated crash, disclosure primitive, exploit chain, or affected-hardware matrix. Exact distribution exposure requires backport analysis.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable upstream stable fix.
- Check distribution security advisories because fixes may be backported without changing to an obvious upstream version.
- Prioritize shared, multi-user, or workload-hosting systems that load AMDGPU.
- Follow Linux or distribution guidance if an upgrade cannot be deployed promptly.
Validation and detection
- Inventory Linux hosts with AMD graphics hardware and the AMDGPU module loaded.
- Record running kernel builds and map them to distribution advisories or supplied stable commits.
- Confirm the installed kernel package includes the bounds-checking fix or an equivalent backport.
- After remediation, reboot where required and verify the intended fixed kernel is running.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46218 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2LinuxVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/5da6c6430be0acb25b4242bce0323fc514d4e3cfCVE reference, Linux
- https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53fCVE reference, Linux
- https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7dCVE reference, Linux
- https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6CVE reference, Linux
- https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7CVE reference, Linux
- https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9eCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.