UBUNTU-CVE-2026-97493: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev->i2cbus[] or walk an absurd number of entries on corrupt size fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reject undersized VBIOS GPIO I2C tables and cap the derived table entry count at AMDGPU_MAX_I2C_BUS to prevent overrunning adev->i2c_bus[] or iterating excessively due to corrupt size fields.
Event History
Frequently Asked Questions
Which Ubuntu systems are in scope?
The advisory lists Ubuntu systems using the linux, linux-fips, linux-aws, linux-azure, linux-aws-fips, linux-azure-fips, linux-gcp, or linux-gcp-fips kernel packages. The affected code is in the AMDGPU DRM driver.
What condition is required to trigger the issue?
The AMDGPU driver must parse a VBIOS GPIO I2C table with an undersized table or corrupt size fields. Those fields can otherwise produce an excessive derived entry count and overrun the driver's I2C bus array or cause it to walk an unreasonable number of entries.