CVE-2026-97427: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/pm: bound ppdpmsetpptable() memcpy
The powerplay path allocates hardcodepptable once with kmemdup(..., softpptablesize). memcpy(..., size) used the sysfs store count (up to PAGESIZE) with no upper bound, causing heap overflow. Reject writes where size exceeds softpptablesize.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In drm/amd/pm pp_dpm_set_pp_table(), bound the memcpy size to soft_pp_table_size and reject writes where size exceeds soft_pp_table_size.
Event History
Frequently Asked Questions
What is required to trigger the vulnerable path?
The vulnerable path is reached through a sysfs store operation that supplies a powerplay table. An input whose size exceeds soft_pp_table_size can cause the copy to exceed the allocation; the supplied size could be up to PAGE_SIZE.
How can I verify that the fix is present?
Inspect the pp_dpm_set_pp_table() handling for a size check that rejects writes when size exceeds soft_pp_table_size before the memcpy is performed.