CVE-2026-97493: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev->i2cbus[] or walk an absurd number of entries on corrupt size fields.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the AMDGPU driver are exposed when they process a VBIOS GPIO I2C table with corrupt size fields. The issue concerns parsing of that firmware-provided table.
What would an attacker need to exploit it?
The vulnerable code is reached through a malformed or corrupt GPIO I2C table in the GPU VBIOS. The provided information does not establish how an attacker could cause a system to use such a VBIOS.
How can I tell whether a system has the fix?
A fixed kernel rejects undersized GPIO I2C tables and limits the derived entry count to AMDGPU_MAX_I2C_BUS. The listed stable kernel references identify commits containing the correction.