drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.
Références
- https://git.kernel.org/stable/c/ed84504713e8357f33693f638fda68fc98f0c9d2
- https://git.kernel.org/stable/c/86644d37d2b388854b2cfd4d4f57b3d84a57154b
- https://git.kernel.org/stable/c/e5b3c485ef911358752a3abbf3705d05d0eafd7a
- https://git.kernel.org/stable/c/574af7c61f2bed37baa3b60669e428d24d2c9ae8
- https://git.kernel.org/stable/c/203ffe648948ca3c2f55b21118945a7a6d0884aa
- https://git.kernel.org/stable/c/0a6c9b3801903b6db91f3cbf148646b501dbded3
- https://git.kernel.org/stable/c/83c680de6d41d627c077dedb24f89d9e5be0e2a2
- https://git.kernel.org/stable/c/5d3cc8e388464f485d0944b87b8f9426e637d082
Références européennes
- ENISA EUVD · EUVD-2026-82287
- GCVE · GCVE-0-2026-93179
Avis du CERT-FR
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected c82baa28184356a75c0157129f88af42b2e7b695 < ed84504713e8357f33693f638fda68fc98f0c9d2 ; affected c82baa28184356a75c0157129f88af42b2e7b695 < 86644d37d2b388854b2cfd4d4f57b3d84a57154b ; affected c82baa28184356a75c0157129f88af42b2e7b695 < e5b3c485ef911358752a3abbf3705d05d0eafd7a ; affected c82baa28184356a75c0157129f88af42b2e7b695 < 574af7c61f2bed37baa3b60669e428d24d2c9ae8 ; affected c82baa28184356a75c0157129f88af42b2e7b695 < 203ffe648948ca3c2f55b21118945a7a6d0884aa ; affected c82baa28184356a75c0157129f88af42b2e7b695 < 0a6c9b3801903b6db91f3cbf148646b501dbded3 |
| Linux · Linux | affected 4.5 ; unaffected 0 < 4.5 ; unaffected 5.10.273 ≤ 5.10.* ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |