CVE-2026-93179 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read
Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Direct Rendering Manager subsystem for AMD graphics hardware contains a critical input validation flaw within the powerplay driver component that handles voltage object information structures. This vulnerability arises from insufficient boundary checking during the parsing of data provided by the Video BIOS, specifically regarding the VoltageObjectInfo table structure. The core technical issue involves an incorrect handling of the usSize field associated with individual voltage objects embedded in this table. When processing these objects, the driver iterates through them using a loop that advances a cursor based on the size specified for each object. However, prior to the fix, there was no rigorous validation ensuring that the declared size is sufficient to contain at least the minimum header structure required by the specification, nor was there adequate verification that advancing the cursor by this amount would remain within the bounds of the allocated memory buffer containing the table data.
This lack of strict boundary enforcement creates two distinct failure modes depending on how a malicious or malformed VBIOS image is constructed. If an attacker can influence the content of the VoltageObjectInfo table, such as through a compromised firmware update or by exploiting other system vulnerabilities to modify kernel memory structures that are subsequently read during initialization, they can supply a usSize value that equals zero or is otherwise smaller than the expected header size. In scenarios where the size indicates no data consumption but the loop logic does not properly account for this edge case, it results in an infinite loop. This condition effectively causes a denial of service by consuming CPU resources indefinitely and preventing further system operations related to power management until the process is forcibly terminated or the system reboots.
More critically, if the usSize value is set such that advancing the cursor moves past the end of the allocated buffer but does not trigger an immediate segmentation fault due to memory mapping protections, it leads to a heap-based out-of-bounds read. This allows for the leakage of sensitive kernel memory contents located immediately after the voltage table structure in physical or virtual memory space. Such information disclosure can expose cryptographic keys, internal system states, or other privileged data that could be leveraged by local attackers to facilitate further exploitation chains. The vulnerability is particularly severe because it resides in a component loaded early during boot processes and interacts directly with hardware-specific firmware interfaces, making the attack surface accessible through physical access attacks involving malicious peripheral devices or compromised BIOS/UEFI implementations.
From a classification perspective, this flaw aligns closely with CWE-125 Out-of-bounds Read and CWE-835 Loop with Unreachable Exit Condition within the Common Weakness Enumeration framework. In terms of tactical behavior as defined by MITRE ATT&CK techniques, it relates to T1059 Command and Scripting Interpreter if leveraged for denial of service via resource exhaustion, or potentially T1005 Data from Local System for information gathering through memory leakage. The vulnerability underscores the risks associated with trusting unverified data structures provided by lower-level system components like VBIOS without rigorous sanity checks on structural integrity and size constraints.
Mitigation strategies primarily involve applying the upstream kernel patch that introduces strict validation logic before processing voltage objects. This includes verifying that usSize is greater than or equal to the minimum required header size and ensuring that cursor advancement does not exceed the total table length. System administrators should ensure their systems are updated with the latest stable Linux kernel versions where this fix has been integrated. For environments unable to immediately patch, restricting physical access to hardware components and implementing strict firmware integrity verification mechanisms such as Secure Boot can help prevent the loading of maliciously crafted VBIOS images that exploit this parsing logic flaw.