CVE-2026-97494: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw
Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer.
Replace open-coded memset/memcpy into fwpribuf with pspcopyfw.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The issue applies to Linux kernel systems using the AMDGPU DRM driver and its PSP firmware handling paths. The provided data does not identify specific affected kernel versions or hardware models.
What conditions trigger the vulnerable behavior?
The relevant condition is copying a firmware image into the PSP 1 MiB private buffer without validating that the image size is nonzero and does not exceed that buffer. The fix also handles failure to enter the DRM device context.
What should be done if an update cannot be applied immediately?
The provided data does not describe a workaround or mitigation. The available remediation is to use a kernel containing the change that routes these copies through psp_copy_fw with size validation.
How can I determine whether my kernel contains the fix?
Check whether the AMDGPU PSP code uses psp_copy_fw for firmware private-buffer copies, and whether that function returns -EINVAL for zero-sized or over-1 MiB images and -ENODEV when drm_dev_enter fails. The listed stable kernel references identify commits containing the remediation.