CVE-2026-93178drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of range.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c82baa28184356a75c0157129f88af42b2e7b695 before d9ef085114d1e3c2c1f869c0bdb275a7b358ce8b; from c82baa28184356a75c0157129f88af42b2e7b695 before 6f08c001fa6e8212930d694540ae8d9d6d3fb58a; from c82baa28184356a75c0157129f88af42b2e7b695 before ce0d8e72836c9d3710a160ad848b0f1d096075e3; from c82baa28184356a75c0157129f88af42b2e7b695 before 745297208d31222f916cc04da313cb737b997935; from c82baa28184356a75c0157129f88af42b2e7b695 before f925d317d84d401d642e537ea18ee12f67cb6983; from c82baa28184356a75c0157129f88af42b2e7b695 before 8a3db9f593b643904c6cc6d8a3f211c84ca6cf8a; from c82baa28184356a75c0157129f88af42b2e7b695 before 1664327ce797e09e387dc10cbbaa5b8d76558d2c; from c82baa28184356a75c0157129f88af42b2e7b695 before 3a8a05477cda6c8293e2b629495b42981dcaba32 | CNA record |
References
- https://git.kernel.org/stable/c/d9ef085114d1e3c2c1f869c0bdb275a7b358ce8b
- https://git.kernel.org/stable/c/6f08c001fa6e8212930d694540ae8d9d6d3fb58a
- https://git.kernel.org/stable/c/ce0d8e72836c9d3710a160ad848b0f1d096075e3
- https://git.kernel.org/stable/c/745297208d31222f916cc04da313cb737b997935
- https://git.kernel.org/stable/c/f925d317d84d401d642e537ea18ee12f67cb6983
- https://git.kernel.org/stable/c/8a3db9f593b643904c6cc6d8a3f211c84ca6cf8a
- https://git.kernel.org/stable/c/1664327ce797e09e387dc10cbbaa5b8d76558d2c
- https://git.kernel.org/stable/c/3a8a05477cda6c8293e2b629495b42981dcaba32
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.