Executive brief
The Linux kernel's AMD GPU driver contains a buffer overflow vulnerability in the vBIOS (video BIOS) update mechanism. An attacker with local access and permissions to write to the PSP vBIOS sysfs interface could write data beyond the buffer boundaries, potentially corrupting kernel memory and gaining elevated privileges or crashing the system.
Technical details
The amdgpu PSP (Platform Security Processor) vBIOS flash binary attribute had its size set to 0, allowing unbounded writes via the psp_vbflash sysfs interface despite validation logic existing in the VFS layer. The fix sets the bin_attribute.size to AMD_VBIOS_FILE_MAX_SIZE_B to properly constrain write operations. This is a local privilege escalation vulnerability affecting systems with AMD GPUs that allow unprivileged sysfs access to the vBIOS update interface.
Affected products
- Linux Linux kernel multiple versions (fix applied to stable series)
Timeline
- 2026-05-13: disclosed: Commit authored by Shiwu Zhang
- 2026-06-03: patched: Fix merged to mainline (commit 6229898d)
- 2026-09-21: patched: Fix included in stable kernel releases