HIGH Introduced in 4.12
amdgpu PspFwBuf Overflow
CVE-2026-97494
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw Change psp_copy_fw from void to int: return -ENODEV when drm_dev_enter fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Replace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw.
02KernelScan AI Analysis
Risk summary
Systems with AMD GPU hardware are at risk of a heap buffer overflow in the PSP firmware loader. A malformed or oversized firmware binary can corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. The vulnerability requires local access and AMD GPU hardware with PSP support.
Vulnerability analysis
The AMD GPU PSP driver copies firmware binaries into a fixed one-megabyte private buffer using a helper that performs no size validation. When the firmware image size exceeds the buffer capacity, the copy overwrites heap memory beyond the allocated buffer, and several call sites were performing the same copy in open-coded form without any bounds check. The fix adds validation to the shared copy helper — rejecting empty images and images larger than the buffer — and makes the helper return errors when the GPU has been hot-unplugged so callers stop instead of proceeding with stale or missing data. The vulnerable code path is in the amdgpu driver and requires AMD GPU hardware with a PSP; it is reached locally during firmware loading at device initialization and through related PSP trusted-application operations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.12 | 6.12.111 | 25bec2425c3d |
| 6.18 | 4.12 | 6.18.53 | 1aa55af304a2 |
| mainline | 4.12 | 7.2 | d1f9f5839bd7 |
| cip/6.12 | 4.12 | 6.12.111-cip32 | 25bec2425c3d |