Executive brief
AMD's GPU power management driver contains a buffer overread vulnerability in its SMU7 voltage control logic. A malformed BIOS table could cause the kernel to access invalid memory when reading GPU voltage parameters, potentially leading to system crashes or information disclosure affecting systems with AMD GPUs.
Technical details
This is an array bounds check vulnerability in the amdgpu powerplay driver's SMU7 hardware management module. The vddInd and vddcInd fields parsed from GPU VBIOS tables are used directly as indices into voltage lookup tables without validation, enabling out-of-bounds reads. An attacker with local access or ability to influence GPU firmware tables could trigger a kernel panic or information leak. The fix adds bounds checking before table lookups, returning -EINVAL for out-of-range indices. The vulnerability originates from commit c82baa281843 (Tonga DPM support) and has been patched as of kernel 6.1.y and later stable branches.
Affected products
- Linux kernel 5.4 through 6.9 and later
Timeline
- 2026-09-17: disclosed
- 2026-07-01: patched: fix committed upstream