CVE-2026-93177: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

Published Sep 17, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.

Affected Software

1 affected component

Linux Kernel

Event History

Sep 17, 2026

CVE Published

via MITRE·04:12 PM

Data Sourced

via MITRE·04:12 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Exposure is limited to Linux kernel systems using the AMDGPU PowerPlay path for Vega10, where VBIOS-parsed voltage-table indices are used.

What condition is required to trigger the flaw?

The VBIOS-parsed tables must contain an out-of-range vddInd, vddciInd, or mvddInd value that is used to index the corresponding voltage lookup table.

How can affected systems be identified or mitigated before patching?

The provided data does not describe a detection method or workaround. The fix changes the affected lookup sites to reject invalid indices with -EINVAL.