Executive brief
The Linux kernel's AMD PowerPlay power management driver contains a flaw in parsing voltage configuration tables supplied by BIOS firmware. When the firmware provides a malformed table with invalid stride values, the driver can enter an infinite loop or read memory outside the table bounds, potentially causing system instability or kernel crashes.
Technical details
The vulnerability is a boundary-check bypass in voltage table parsing code within the AMD PowerPlay hardware manager (ppatomctrl.c and ppatomfwctrl.c). The root cause is insufficient validation of the VoltageObjectInfo table entries when iterating through voltage objects: specifically, the code did not verify that object sizes were large enough to contain their headers or that advancing the cursor would not exceed the table boundary. An attacker or malicious BIOS firmware could craft a VoltageObjectInfo table with zero-stride or undersized entries to trigger either an infinite loop (denial of service) or heap out-of-bounds read. The fix adds explicit size validation before each iteration, rejecting any voltage object whose size is smaller than the header structure or would cause the offset to exceed the table end. This is a local vulnerability requiring BIOS/firmware manipulation.
Affected products
- Linux Linux kernel Multiple versions; patched in 5.15.x, 6.1.x, and later stable branches
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-07-01: patched: Upstream patch merged; backported to stable branches by 2026-09-14