Linux Kernel AMDGPU BO List Entry Count Limit Vulnerability

A resource exhaustion vulnerability has been addressed in the Linux kernel's AMDGPU graphics driver. Userspace could previously send an arbitrary number of buffer object (BO) list entries, potentially leading to excessive memory allocation—up to several gigabytes—and prolonged processing times. The vulnerability has been mitigated by introducing a hard limit of 128,000 entries per BO list, which is adequate for realistic use cases. This change prevents memory exhaustion attacks and ensures consistent performance. The vulnerability was resolved by adding a check that returns an error if the requested entry count exceeds the limit.

Impact

The vulnerability could have been exploited to cause memory exhaustion, leading to excessive memory use and degraded performance.