Executive brief
The Linux kernel's AMD GPU power management driver for Vega10 graphics processors failed to validate array indices before looking up voltage values in internal tables. A malicious or corrupted BIOS firmware could provide out-of-bounds indices, allowing attackers with local system access or firmware modification capabilities to trigger memory access violations, leading to system crashes or potential code execution.
Technical details
The vulnerability is a missing bounds check (CWE-129) in the DRM AMD GPU PowerPlay hwmgr driver (vega10_hwmgr.c). Voltage indices (vddInd, vddciInd, mvddInd) parsed from VBIOS tables were used to index into lookup tables (vddc, vddci, vddmem) without prior validation across nine code sites. An attacker who can modify system firmware or provide a crafted BIOS image could supply out-of-bounds index values, causing the kernel to read or write beyond allocated array bounds. The fix adds explicit bounds checks before each table access and returns -EINVAL if an index exceeds the lookup table size. Exploitation requires local access or firmware modification capability; the vulnerability was patched in Linux 6.1.26 and later versions.
Affected products
- Linux Linux kernel prior to 6.1.26
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched