CVE-2026-97494

The Linux kernel contains a vulnerability in the drm/amdgpu driver related to the psp_copy_fw function. The issue stems from a lack of validation when handling PSP fw_pri_buf copies, where the function previously failed to properly check for errors during drm_dev_enter or validate image sizes. To...

CVE-2026-97494 drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97493 drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

CVE-2026-97493

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the bound GPIO I2C table entry count is sourced from the VBIOS . This can lead to a buffer overrun of adev->i2c_bus[] if the table is undersized or the count is excessively large due to corrupt size fields. The fix involv...

EUVD-2026-86091

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

EUVD-2026-86092

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97494 drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97493 drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

EUVD-2026-86041

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428 drm/amdgpu: harden FRU PIA parsing with bounded helpers

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428 drm/amdgpu: harden FRU PIA parsing with bounded helpers

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...

CVE-2026-97428

The Linux kernel contains a vulnerability within the drm/amdgpu component related to FRU PIA parsing . The root cause is an open-coded TLV walk that fails to properly bound reads against the actual EEPROM data length , potentially leading to out-of-bounds reads when processing truncated or malfor...

CVE-2026-97426 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

CVE-2026-97426

The Linux kernel contains a vulnerability in the drm/amdgpu/pm component related to the SmartShift bias sysfs store . The root cause is that the system returns a parse error before acquiring the PM refcount , which can lead to issues during error handling. A fix has been implemented to ensure the...

CVE-2026-97426 drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error Return the parse error before acquiring PM access...

EUVD-2026-86038

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97425

A buffer overflow vulnerability exists in the Linux kernel within the drm/amdgpu component during a vBIOS update . The root cause is an improper handling of buffer positions, which could allow out-of-bounds access. The issue is resolved by clamping the buffer position to the maximum buffer size u...

CVE-2026-97425 drm/amdgpu: fix buffer overflow during vBIOS update

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing...

CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...