CVE-2026-31766
Published: 01 May 2026
Summary
CVE-2026-31766 is a high-severity an unspecified weakness vulnerability in Linux Linux Kernel. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 3.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31766 is a vulnerability in the Linux kernel's Direct Rendering Manager (DRM) AMDGPU driver, specifically during user queue creation in the amdgpu_userq_get_doorbell_index() function. The issue arises because a user-provided doorbell_offset value is passed to amdgpu_doorbell_index_on_bar() without bounds checking. An excessively large doorbell_offset can result in a calculated doorbell index that falls outside the allocated doorbell buffer object (BO), potentially leading to corruption of kernel doorbell space.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction required. Successful exploitation allows high-impact integrity (I:H) and availability (A:H) violations with no confidentiality impact (C:N), enabling kernel memory corruption in the doorbell region. This could facilitate privilege escalation, denial of service, or further kernel compromise.
Mitigation involves applying stable kernel patches that validate the doorbell_offset to ensure it falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. Relevant commits include 3543005a42d7e8e12b21897ef6798541bf7cbcd3, 86b732fbc37ce4fb76cdd4af0fb7e30a6acdbce6, and a018d1819f158991b7308e4f74609c6c029b670c, which were cherry-picked from upstream fix de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26579
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate doorbell_offset in user queue creation amdgpu_userq_get_doorbell_index() passes the user-provided doorbell_offset to amdgpu_doorbell_index_on_bar() without bounds checking. An arbitrarily large doorbell_offset can cause the calculated doorbell index to fall outside…
more
the allocated doorbell BO, potentially corrupting kernel doorbell space. Validate that doorbell_offset falls within the doorbell BO before computing the BAR index, using u64 arithmetic to prevent overflow. (cherry picked from commit de1ef4ffd70e1d15f0bf584fd22b1f28cbd5e2ec)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel out-of-bounds doorbell offset write enables local memory corruption leading directly to privilege escalation (T1068) and system/application DoS via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-provided inputs like doorbell_offset to prevent out-of-bounds access and kernel memory corruption.
Mandates timely identification, reporting, and correction of flaws such as the missing bounds check in the AMDGPU driver via kernel patching.
Implements memory protection mechanisms to mitigate corruption in kernel doorbell space from invalid offset calculations.