CVE-2026-97427drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy The powerplay path allocates hardcode_pp_table once with kmemdup(..., soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to PAGE_SIZE) with no upper bound, causing heap overflow. Reject writes where size exceeds soft_pp_table_size.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a before abe61d067b48b947bedc9bae3725cb8f48dc8c0a; from b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a before 9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9; from b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a before 43d2ab8408f9f468b232350c74160ae21e763020; from b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a before 3334985f8b4c7c637a829744c81518ad9a671bcb; from b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a before f193e71fa9fab2e68ef85201b106e8f580d3a25b | CNA record |
References
- https://git.kernel.org/stable/c/abe61d067b48b947bedc9bae3725cb8f48dc8c0a
- https://git.kernel.org/stable/c/9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9
- https://git.kernel.org/stable/c/43d2ab8408f9f468b232350c74160ae21e763020
- https://git.kernel.org/stable/c/3334985f8b4c7c637a829744c81518ad9a671bcb
- https://git.kernel.org/stable/c/f193e71fa9fab2e68ef85201b106e8f580d3a25b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.