AMD patches critical VCN3 driver vulnerability affecting RDNA2 video engines
A critical security vulnerability, CVE-2026-46230, was discovered in AMDGPU's VCN3 driver via static analysis, affecting RDNA2 GPUs and APUs. The flaw, a missing bounds check in the video decoder engine, has been patched in the Linux kernel. This discovery is part of a series of similar bugs found across multiple VCN generations, highlighting persistent driver code weaknesses.
Key Takeaways
- CVE-2026-46230 carries a CVSS 3.1 score of 7.1 (High) and affects Radeon RX 6000 series GPUs and specific APUs.
- The flaw stems from insufficient input validation when processing message buffers within the Video Core Next 3.0 hardware block.
- Similar vulnerabilities, including CVE-2026-46199 and CVE-2026-46204, were also discovered in the newer VCN4 path via automated static analysis.
- Linux kernel patches have been released to introduce explicit bounds validation against the end of the buffer object.
Why It Matters
This vulnerability turns the video-decoding hardware—a staple of media-heavy streaming environments—into a potential vector for kernel-level memory exploitation. While requiring local access, the discovery of related bugs across VCN3 and VCN4 generations indicates a pattern of systemic oversights in recycled driver logic. For streaming infrastructure providers using GPU-accelerated encoding or multi-user cloud instances with GPU passthrough, this heightens the risk of unauthorized data access between tenants. The move to automated code scanning suggests more driver-level flaws may emerge as old hardware paths face modern security audits. Organizations should track distribution-specific kernel backports to ensure media engines remain isolated from non-privileged user space threats.
Additional Context
The disclosure of CVE-2026-46230 is part of a broader wave of hardware-related driver security audits impacting the Linux ecosystem. Per reports from SentinelOne and NIST in May 2026, several other high-severity flaws were simultaneously addressed in the amdgpu driver suite. These include CVE-2026-46218, which affected the Indirect Buffer (IB) bounds checking across Unified Video Decoder (UVD) and Video Compression Engine (VCE) paths. The fix for that specific vulnerability involved changing index types to uint32_t to prevent arithmetic overflows that previously bypassed size comparisons. This cluster of security fixes comes as AMD shifts its driver strategy for older hardware tiers. Per Tom's Hardware and Overclock3D in late 2025, AMD moved its RDNA1 (RX 5000) and RDNA2 (RX 6000) series cards into a 'maintenance mode' branch. While this branch deprioritizes game-specific feature updates in favor of RDNA3 and RDNA4 architectures, AMD has committed to delivering critical security and stability patches for these older generations. The emergence of VCN-related vulnerabilities suggests that despite the lack of new features, the large installed base of RX 6000 cards remains a priority for the company's vulnerability response team. In the wider industry, GPU manufacturers are facing increased scrutiny regarding kernel-mode memory safety. For instance, per SecurityWeek in May 2026, Intel recently addressed a critical buffer overflow (CVE-2026-20794) in its data center graphics drivers for VMware ESXi. These concurrent disclosures from major chipmakers underscore a shift where GPU drivers are now treated as primary attack surfaces alongside network stacks and hypervisors, particularly in virtualized environments where media acceleration is a standard requirement for streaming and AI workloads.
Read full article at igorslab.de
Get this in your inbox → Subscribe
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source