Riskcovery

CVE-2026-97428

drm/amdgpu: harden FRU PIA parsing with bounded helpers

State
Published
Severity
7.7 High
Published
Sep 24, 2026
Updated
Oct 21, 2026
Reserved
Sep 24, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: harden FRU PIA parsing with bounded helpers

Replace the open-coded TLV walk with fru_pia_advance() and fru_pia_copy_field() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.

Scores

CVSSScoreVectorSource
3.17.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0dbf2c56262532fbd498f590c91c4085413b8829 to before 567d7c3f93f8d6bdc946a557a160ee1c42cfae91Affected
  • 0dbf2c56262532fbd498f590c91c4085413b8829 to before 813311512505e95e4e3c898ff94b11886a15e494Affected
  • 0dbf2c56262532fbd498f590c91c4085413b8829 to before 4396d74b0c7304946ee343a6611ac6dbc0bfbf78Affected
  • 0dbf2c56262532fbd498f590c91c4085413b8829 to before c990c05eb6c74c98d1ff3acf67a19015312820b7Affected
LinuxLinux
  • 6.2Affected
  • before 6.2Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.