CVE-2026-93179

What it actually does

Malformed VoltageObjectInfo tables in VBIOS can cause an infinite loop or heap out-of-bounds read during parsing when usSize is smaller than the header or advances the cursor past table end.

Why it matters to the business

Systems using affected AMD GPUs may experience crashes, denial of service, or potential information disclosure during power management initialization; low exploitability reduces immediate risk but kernel-level impact affects many Linux deployments.

How an attack unfolds

An attacker with the ability to supply a malicious VBIOS image supplies a VoltageObjectInfo table with an undersized usSize field, triggering the zero-stride loop or out-of-bounds read when the driver parses the table on powerplay initialization.

How to fix it

Update the Linux kernel to a version containing the fix for the VoltageObjectInfo parsing logic in drm/amd/powerplay; rebuild and deploy any custom kernels or distributions that pull in the corrected driver code.

How to confirm the fix worked

Confirm the presence of the upstream commit that adds size and stride checks before advancing the cursor; test with known-malformed VBIOS images to verify rejection without looping or OOB access; review kernel logs for absence of prior panic signatures during powerplay load.

Typical attack path

1. Obtain or craft a VBIOS image containing a malformed VoltageObjectInfo table
2. Load the VBIOS on an affected AMD GPU system
3. Trigger AMD powerplay driver initialization or voltage object enumeration
4. Cause infinite loop or OOB read leading to kernel panic or memory disclosure

How to detect it

Review kernel logs for powerplay or drm/amd related OOB or loop-related panics around boot or GPU initialization; no public exploitation artifacts are known given low EPSS and absence from KEV.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs in production or high-availability environments
• Monitor upstream kernel changelogs for backports to supported distribution branches
• Restrict untrusted VBIOS loading or firmware updates until patched kernels are deployed