Linux amdgpu powerplay: malformed VBIOS VoltageObjectInfo table causes infinite loop or heap OOB read

Impact

The amdgpu power management code walked the VBIOS VoltageObjectInfo table without checking that each entry's usSize was at least the header size or that it stayed inside the table, so a malformed table could spin the cursor forever or read past the heap allocation. The practical exposure is narrow: the data comes from the card's own VBIOS, so triggering it means supplying a crafted or corrupted VBIOS - a flashed card, a tampered option ROM, or a passed-through virtual device whose ROM the guest controls. Where it does fire, it hangs or faults during driver init on an AMD accelerator node, which means the node comes up without GPUs and has to be taken out of the scheduling pool.

Who can reach it

Not reachable from a normal GPU tenant. Requires control over the VBIOS image the driver reads - physical or administrative access to flash the card, or a virtualization setup in which an untrusted guest supplies the device ROM to a host driver.

What to do

Pick up the stable kernel containing the fix (commits linked in the record) on AMD GPU nodes; a kernel update means drain and reboot each node. Given the attack path requires control of the VBIOS, this is reasonable to roll in with the next scheduled kernel maintenance rather than an emergency window. Treat option-ROM/VBIOS flashing as a privileged operation and verify card firmware on nodes that have been physically serviced or returned from RMA.

References

Related entries

• Linux kernel amdgpu: use of freed module text when RCU callbacks run after module unloadCVE-2026-93809 · Linux kernel amdgpu (missing rcu_barrier() on module unload)Unscored
• Linux kernel amdkfd: user-controlled metadata size lets any render-group user force a huge kernel allocationCVE-2026-93823 · Linux kernel amdkfd (AMDKFD_IOC_GET_DMABUF_INFO metadata buffer)Unscored
• Linux kernel amdgpu: unclamped write position in the vBIOS update sysfs attribute overflows the bufferCVE-2026-97425 · Linux kernel amdgpu (vBIOS update sysfs bin attribute)Unscored
• Linux kernel amdgpu powerplay: pp_table sysfs write memcpys up to PAGE_SIZE into a smaller heap bufferCVE-2026-97427 · Linux kernel amdgpu powerplay (pp_dpm_set_pp_table sysfs store)Unscored
• Linux kernel drm/amdgpu: unbounded VBIOS GPIO I2C entry count overruns adev->i2c_bus[]CVE-2026-97493 · Linux kernel amdgpu VBIOS GPIO I2C table parsing (drm/amdgpu)Unscored
• Linux amdgpu: PSP firmware image copied into the 1 MiB private buffer without a size checkCVE-2026-97494 · Linux kernel drm/amdgpu (PSP firmware private buffer, psp_copy_fw)Unscored