Executive brief
A vulnerability in the Linux kernel's AMD display driver could allow a malformed Video BIOS (VBIOS) image to cause the system to hang or crash. The issue occurs when the driver attempts to read hardware configuration data from the graphics card but encounters a corrupted or malicious image that lacks proper termination markers. This can lead to an infinite loop or memory reading errors during the system startup or hardware probing process, potentially impacting system availability.
Technical details
A vulnerability exists in the AMD display driver (dc/bios) within the Linux kernel's bios_parser.c and bios_parser2.c components. The parser uses unbounded loops to walk VBIOS record chains, relying on a specific sentinel value (0xFF) or a zero record size for termination. If a malformed VBIOS image is provided—either through malicious hardware or firmware tampering—the parser can enter an infinite loop or perform out-of-bounds reads when casting structures near the BIOS image boundary. The fix introduces a hard limit of 256 iterations (BIOS_MAX_NUM_RECORD) for all 14 record-chain walk loops to ensure termination. This issue is primarily reachable at device probe time.
Affected products
- Linux Linux 4.15 to 6.12.94, 6.18.36, 7.0.13
Timeline
- 2026-06-25: disclosed
- 2026-06-25: advisory