Executive brief
A vulnerability in the Linux kernel's AMD display driver could allow an attacker with high privileges to cause a system crash or read sensitive memory. The issue occurs when the system processes malformed video BIOS (VBIOS) data related to display hardware pins. This could lead to operational disruptions or limited information disclosure on affected Linux systems using AMD graphics hardware.
Technical details
An out-of-bounds read vulnerability exists in the Linux kernel's AMD display driver within `drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c`. The functions `get_gpio_i2c_info()` and `bios_parser_get_gpio_pin_info()` calculate an iteration count based on the `structuresize` field in the VBIOS table header without verifying if that entire size is within the mapped BIOS image. If a VBIOS image provides a `structuresize` larger than the actual data, the subsequent loop iterates past the end of the buffer. This is a local attack requiring the ability to provide or influence VBIOS data (typically requiring high privileges). The vulnerability has been patched by adding calls to `bios_get_image()` to validate the full structure size before iteration.
Affected products
- Linux Linux 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11
Timeline
- 2026-05-04: other: Initial patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/67461e0c15335894cc5d3b84cda823bf8cbdc886
- https://git.kernel.org/stable/c/7ca695b3122297b06a3ed605bbe1cd32c85d9f5a
- https://git.kernel.org/stable/c/86d2b20644b11d21fe52c596e6e922b4590a3e3f
- https://git.kernel.org/stable/c/9900f6954be779011e7c2cd42addd87baf028bc5
- https://git.kernel.org/stable/c/f2a4827e980ba07de4391fa84d9c39a12726bdd7
- https://git.kernel.org/stable/c/fb30a3890d62fd50a95aef684faf64a307592e42