HIGH Introduced in 4.5
amdgpu VoltageIndex OOB
CVE-2026-93178
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI4.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of range.
02KernelScan AI Analysis
Risk summary
AMD GPU systems using SMU7 powerplay (Tonga and similar) can hit an out-of-bounds read when VBIOS-parsed voltage tables contain invalid indices. A local administrator could trigger this during GPU power management initialization, causing a kernel oops or denial of service. The issue requires an AMD GPU with SMU7 powerplay support and a malformed VBIOS table.
Vulnerability analysis
The AMD GPU powerplay driver parses voltage dependency tables from the card's VBIOS and uses index fields from those tables to look up voltage values in separate lookup tables. When those index fields are out of range, the driver reads past the end of the lookup table array, causing an out-of-bounds memory read. The fix adds explicit bounds checks before each array access and returns an error if any index exceeds the lookup table size. This code path is reached during GPU power management initialization on AMD GPUs using the SMU7 powerplay framework, and the malformed data originates from the VBIOS firmware tables rather than from user-supplied input.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.5 | 5.10.270 | d9ef085114d1 |
| 5.15 | 4.5 | 5.15.221 | 6f08c001fa6e |
| 6.1 | 4.5 | 6.1.188 | ce0d8e72836c |
| 6.12 | 4.5 | 6.12.110 | f925d317d84d |
| 6.18 | 4.5 | 6.18.52 | 8a3db9f593b6 |
| 6.6 | 4.5 | 6.6.157 | 745297208d31 |
| 7.2 | 4.5 | 7.2.6 | 1664327ce797 |
| mainline | 4.5 | 7.3 | 3a8a05477cda |
| cip/5.10 | 4.5 | 5.10.271-cip78 | d9ef085114d1 |
| cip/6.1 | 4.5 | 6.1.189-cip61 | ce0d8e72836c |
| cip/6.1-rt | 4.5 | 6.1.189-cip61-rt32 | ce0d8e72836c |
| cip/6.12 | 4.5 | 6.12.111-cip32 | f925d317d84d |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |