CVE-2026-97428: drm/amdgpu: harden FRU PIA parsing with bounded helpers
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: harden FRU PIA parsing with bounded helpers
Replace the open-coded TLV walk with frupiaadvance() and frupiacopyfield() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Replace the open-coded FRU PIA TLV walk in drm/amdgpu with fru_pia_advance() and fru_pia_copy_field() helpers, ensuring every read is bounded by the actual EEPROM data length.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds read?
The affected amdgpu FRU PIA parser must process truncated or malformed FRU data from EEPROM. The issue arises because the prior TLV parsing walk did not bound every read by the actual EEPROM data length.
How can exposure be reduced if the fix cannot be applied immediately?
Avoid using or accepting malformed or truncated FRU EEPROM data on systems using the affected amdgpu parsing path. The provided data does not identify any other workaround or configuration-based mitigation.
How can I determine whether a system has the remediation?
Check whether the kernel includes the amdgpu change that replaces the open-coded FRU PIA TLV walk with the fru_pia_advance() and fru_pia_copy_field() bounded helpers. The listed stable references identify commits containing the fix.