CVE-2026-93177 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Direct Rendering Manager subsystem for AMD GPU drivers contains a critical input validation flaw within the power management interface specifically affecting Vega10 architecture implementations. This vulnerability arises from insufficient boundary checking applied to voltage indices retrieved during the parsing of Video BIOS tables. The affected code paths involve three distinct index variables, namely vddInd representing core voltage, vddciInd for core logic density voltage, and mvddInd for memory voltage. These values are extracted directly from firmware data structures provided by the hardware vendor without adequate verification against the bounds of their corresponding lookup arrays.
The technical nature of this flaw constitutes an out-of-bounds read vulnerability as defined under CWE-125 in common weakness enumeration standards. When these indices exceed the allocated size of the vddc, vddci, or vddmem tables, the kernel attempts to access memory locations outside the intended buffer boundaries. This behavior can lead to information disclosure if the out-of-bounds read exposes sensitive kernel data structures to user-space applications via debug interfaces or sysfs entries that expose power state details. Furthermore, depending on the specific memory layout and subsequent usage of these invalid values, there is a potential risk for denial of service conditions through kernel panics or system instability caused by accessing unmapped or protected memory pages.
From an operational perspective, this vulnerability impacts systems utilizing AMD Vega10 GPUs where userspace applications interact with power management features to query current voltage levels or configure performance states. An attacker with local access who can trigger the parsing of malformed VBIOS tables or manipulate related ioctl calls could exploit this lack of validation. The flaw exists across nine distinct code sites within the powerplay module, indicating a systemic oversight in input sanitization rather than an isolated incident. This widespread nature increases the attack surface and complicates remediation efforts if not addressed comprehensively across all affected functions.
The mitigation strategy implemented by the kernel maintainers involves adding explicit bounds checks before any array access occurs at each of the nine identified locations. By validating that vddInd, vddciInd, and mvddInd fall within the valid range defined by the size of their respective lookup tables, the driver ensures safe memory access patterns. If an index is found to be out of range, the function returns -EINVAL, signaling an invalid argument error to the caller rather than proceeding with unsafe operations. This defensive programming approach aligns with secure coding practices recommended for kernel development and prevents potential exploitation vectors associated with buffer over-reads.
This issue relates to ATT&CK technique T1083 which involves file and directory discovery, as attackers may attempt to read sensitive information from the system through such vulnerabilities in device drivers that expose hardware state details. The fix reinforces the principle of least privilege by ensuring that only valid, verified data is processed within the kernel space. System administrators should ensure their kernels are updated with patches containing this specific commit for Vega10-based AMD graphics cards to maintain system integrity and prevent potential information leakage or stability issues stemming from malformed power management inputs.