CVE-2026-97428 (GCVE-0-2026-97428)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:03 – Updated: 2026-09-25 12:44
VLAI
Title
drm/amdgpu: harden FRU PIA parsing with bounded helpers
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with fru_pia_advance() and fru_pia_copy_field() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0dbf2c56262532fbd498f590c91c4085413b8829 , < 813311512505e95e4e3c898ff94b11886a15e494 (git)
Affected: 0dbf2c56262532fbd498f590c91c4085413b8829 , < 4396d74b0c7304946ee343a6611ac6dbc0bfbf78 (git)
Affected: 0dbf2c56262532fbd498f590c91c4085413b8829 , < c990c05eb6c74c98d1ff3acf67a19015312820b7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "813311512505e95e4e3c898ff94b11886a15e494",
              "status": "affected",
              "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
              "versionType": "git"
            },
            {
              "lessThan": "4396d74b0c7304946ee343a6611ac6dbc0bfbf78",
              "status": "affected",
              "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
              "versionType": "git"
            },
            {
              "lessThan": "c990c05eb6c74c98d1ff3acf67a19015312820b7",
              "status": "affected",
              "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed IPMI FRU Product Info Area TLV lengths (pia[addr] \u0026 0x3F) are consumed by amdgpu_fru_get_product_info() after amdgpu_eeprom_read() on adev-\u003epm.fru_eeprom_i2c_bus, reached from amdgpu_pci_probe() \u2192 amdgpu_driver_load_kms() \u2192 amdgpu_device_init() \u2192 amdgpu_device_ip_init(). Those bytes come from the GPU I2C FRU EEPROM, not a network protocol or USB descriptor.\nAC:L - A FRU image with valid Common Header and PIA checksums but TLV lengths that extend past the kmalloc\u0027d pia buffer makes the pre-fix memcpy of manufacturer_name, product_name, product_number, serial, and fru_id overread on every probe. The attacker programs those EEPROM bytes; skipped Product Version/Asset Tag advances also lack a bounds check. No race.\nPR:N - amdgpu_fru_get_product_info() runs from amdgpu_device_ip_init() during amdgpu_pci_probe() with no capable() or credential check. is_fru_eeprom_supported() only matches server SKUs (Vega20 D161/D163, Aldebaran, SMU 13.0.6/13.0.14) and skips SR-IOV VFs and APUs; a crafted FRU on a supported GPU is parsed without a host account.\nUI:N - amdgpu_pci_probe() calls amdgpu_fru_get_product_info() automatically while binding a supported AMD server GPU; no victim must open a DRM node, mount media, or write sysfs.\nS:U - The memcpy overread of the kzalloc\u0027d pia buffer and the later 0444 sysfs emit stay in this host kernel\u0027s amdgpu driver. is_fru_eeprom_supported() returns false for amdgpu_sriov_vf(), so this is not a guest-to-host or IOMMU boundary crossing.\nC:H - Pre-fix memcpy(fru_info-\u003eproduct_name, pia+addr+1, min(64, pia[addr]\u00260x3F)) and the manufacturer_name/product_number/serial/fru_id copies do not cap the length to remaining PIA bytes, so a 6-bit length near the end of pia reads up to 63 bytes of adjacent kernel heap. amdgpu_fru_product_name_show and sibling 0444 attributes then emit those fields; that is not a few-byte leak.\nI:N - Each memcpy destination is min\u0027d against sizeof(fru_info-\u003emanufacturer_name/product_name/product_number/serial/fru_id), so the TLV walk does not write past those arrays or other kernel objects. This path has no out-of-bounds write or control-flow hijack primitive.\nA:H - A short PIA (size = buf[1]*8, e.g. 8 bytes) plus a product_name field length of 63 makes memcpy() walk tens of bytes past the kzalloc\u0027d pia object into unmapped or poisoned slab and oops inside amdgpu_fru_get_product_info() during probe."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T12:44:04.418Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494"
        },
        {
          "url": "https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78"
        },
        {
          "url": "https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7"
        }
      ],
      "title": "drm/amdgpu: harden FRU PIA parsing with bounded helpers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97428",
    "datePublished": "2026-09-24T16:03:41.103Z",
    "dateReserved": "2026-09-24T14:53:16.868Z",
    "dateUpdated": "2026-09-25T12:44:04.418Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-97428",
      "date": "2026-09-25",
      "epss": "0.0014",
      "percentile": "0.02752"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "813311512505e95e4e3c898ff94b11886a15e494",
                    "status": "affected",
                    "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4396d74b0c7304946ee343a6611ac6dbc0bfbf78",
                    "status": "affected",
                    "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c990c05eb6c74c98d1ff3acf67a19015312820b7",
                    "status": "affected",
                    "version": "0dbf2c56262532fbd498f590c91c4085413b8829",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.111",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.53",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."
          }
        ],
        "id": "CVE-2026-97428",
        "lastModified": "2026-09-25T13:17:26.390",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-24T17:17:20.797",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-25T23:47:37Z",
      "cve": "CVE-2026-97428",
      "id": "CVE-2026-97428",
      "initial_release_date": "2026-09-24T23:46:17Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-97428",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-97428.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.