CVE-2026-93177
High · 7.3CVSS
7.3
EPSS
0.2%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A flaw in how Linux handles power settings for certain AMD graphics cards can let a logged-in user cause system crashes or potentially run code at a higher privilege level.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Missing bounds checks on vddInd, vddciInd and mvddInd values parsed from VBIOS tables allow out-of-bounds indexing into vddc, vddci and vddmem lookup tables at nine locations in the Vega10 powerplay code path, enabling invalid memory reads or writes during voltage lookup operations.
Why it matters to the business
Systems using AMD Vega10 GPUs may experience kernel instability, crashes, or memory corruption during power management operations, increasing downtime risk and potential for local privilege escalation on affected Linux deployments.
How an attack unfolds
An attacker with local access supplies or triggers VBIOS-derived tables containing out-of-range voltage indices, causing the powerplay module to perform unchecked lookups that corrupt memory or leak kernel data during GPU power state transitions.
How to fix it
Update the Linux kernel to a version containing the bounds-check patch that returns -EINVAL for out-of-range voltage indices in the amdgpu powerplay Vega10 code; rebuild and reboot with the patched kernel.
How to confirm the fix worked
Inspect kernel source or running version for the added bounds checks returning -EINVAL on vddInd/vddciInd/mvddInd range violations; confirm via kernel logs that powerplay initialization succeeds without oops on valid hardware.
Typical attack path
- Obtain local user access on a Linux system with an AMD Vega10 GPU
- Trigger amdgpu powerplay initialization or dynamic voltage scaling paths
- Provide VBIOS tables with crafted out-of-range voltage indices
- Cause out-of-bounds memory access during index lookup
- Achieve kernel crash, information leak, or memory corruption
How to detect it
Review kernel logs for amdgpu powerplay oops or invalid index warnings; correlate with GPU initialization events and look for unexpected -EINVAL returns or memory access violations in drm/amdgpu traces.
What your security team should do
- Prioritize kernel updates on all systems exposing AMD Vega10 GPUs
- Monitor for amdgpu-related kernel panics until patched
- Restrict local unprivileged access where feasible until remediation
The record
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|