HIGH Introduced in 4.12
amdgpu VoltageIndex OOB
CVE-2026-93177
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
KernelScan AI5.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.
02KernelScan AI Analysis
Risk summary
An attacker who can supply a crafted VBIOS to an AMD Vega10 GPU can trigger out-of-bounds reads in the kernel's power management driver during initialization. This requires either physical access to reflash the GPU firmware or root-level system access, limiting the threat to privileged or physically proximate actors. Impact includes potential kernel instability and limited information disclosure from heap memory adjacent to the lookup tables.
Vulnerability analysis
The AMD Vega10 GPU power management driver parses voltage dependency indices from the card's firmware (VBIOS) and uses them directly as array indices into voltage lookup tables without verifying they fall within the table bounds. A malformed or corrupted VBIOS could supply indices exceeding the lookup table size, causing the driver to read beyond the allocated array during initialization. The fix adds bounds checks at every lookup site and returns an error if any index is out of range, preventing the out-of-bounds access entirely. This vulnerability requires an AMD Vega10 GPU and can only be triggered by supplying crafted VBIOS data, which demands either physical access to the GPU card to reflash its firmware or root-level access to the system to use vendor flashing tools.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.12 | 5.10.270 | 206e478810d6 |
| 5.15 | 4.12 | 5.15.221 | 25dedc13ceb9 |
| 6.1 | 4.12 | 6.1.188 | ae25c92d91f2 |
| 6.6 | 4.12 | 6.6.157 | b349dcf061a6 |
| 6.18 | 4.12 | 6.18.52 | 46d27e56dbd6 |
| 7.2 | 4.12 | 7.2.6 | 06aef6dcc1d5 |
| mainline | 4.12 | 7.3-rc1 | 6fa33f594e46 |
| 6.12 | 4.12 | 6.12.110 | dfe89f1a0c7f |
| cip/6.12 | 4.12 | 6.12.111-cip32 | dfe89f1a0c7f |