CVE-2026-97493: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
Published Sep 24, 2026
·Updated
drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
Affected Software
1 affected component
Linux Linux kernel
Event History
Sep 24, 2026
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Data Sourced
via NVD·05:17 PM
Description
Sep 28, 2026
Data Sourced
via Microsoft·10:41 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which systems are exposed to this issue?
Systems running the Linux kernel with the AMDGPU driver are exposed when they process a VBIOS GPIO I2C table with corrupt size fields. The issue concerns parsing of that firmware-provided table.
2
What would an attacker need to exploit it?
The vulnerable code is reached through a malformed or corrupt GPIO I2C table in the GPU VBIOS. The provided information does not establish how an attacker could cause a system to use such a VBIOS.
3
How can I tell whether a system has the fix?
A fixed kernel rejects undersized GPIO I2C tables and limits the derived entry count to AMDGPU_MAX_I2C_BUS. The listed stable kernel references identify commits containing the correction.