{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93178","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-17T16:02:15.091Z","datePublished":"2026-09-17T16:12:06.631Z","dateUpdated":"2026-09-18T17:56:24.810Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-18T17:56:24.810Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup\n\nvddInd and vddcInd fields from VBIOS-parsed tables are used to index into\nvoltage lookup tables without a bounds check. Return -EINVAL when any\nindex is out of range."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The attacker-controlled ATOM_Tonga_SCLK_Dependency_Record.ucVddInd (and MCLK ucVddcInd / MM ucVddcInd) bytes enter via write() on /sys/class/drm/cardN/device/pp_table; amdgpu_set_pp_table → pp_dpm_set_pp_table copies them into hardcode_pp_table and amd_powerplay_reset → hwmgr_hw_init → pp_tables_v1_0_initialize re-parses them before smu7_patch_voltage_dependency_tables_with_lookup_table uses vddInd.\nAC:L - A PowerPlay table whose ucVddInd/ucVddcInd is >= vddc_lookup_table or vddgfx_lookup_table count makes smu7_patch_voltage_dependency_tables_with_lookup_table perform a deterministic entries[voltage_id].us_vdd load; voltage_id is the attacker-chosen uint8_t and no race or memory-layout gate is required.\nPR:L - pp_table is AMDGPU_DEVICE_ATTR_RW (S_IRUGO|S_IWUSR) and amdgpu_dpm_is_pp_table_allowed() enables it on SMU7 discrete ASICs (Tonga/Fiji/Polaris/VegaM); the same sysfs node was scored PR:L in CVE-2025-21780 and CVE-2026-74450 because AMD desktop/gaming udev rules routinely grant group write for overclocking tools.\nUI:N - The attacker writes the crafted PowerPlay table to pp_table themselves; no other user must plug in a GPU, mount an image, or confirm a prompt.\nS:U - The out-of-bounds us_vdd load targets the kmalloc_flex vddc_lookup_table/vddgfx_lookup_table in the host amdgpu driver and does not cross a KVM/Xen, IOMMU, or sandbox boundary.\nC:H - get_vddc_lookup_table allocates only 16 phm_ppt_v1_voltage_lookup_record slots, but voltage_id is the attacker-supplied uint8_t ucVddInd (0-255), so entries[voltage_id].us_vdd reads two kernel-heap bytes at a chosen offset up to about 2.5KB past the object, repeatable across sclk, mclk, and mm dependency entries.\nI:N - The only stores are in-bounds writes of that 16-bit millivolt into sclk_table/mclk_table/mm_table entries[entry_id].vddc or .vddgfx; those fields are not used as pointers or as further unbounded indexes, so this is not an out-of-bounds write or control-flow hijack primitive.\nA:H - voltage_id 255 walks about 2.5KB past the 16-entry lookup object and can fault on an unmapped or guard page; the same uploaded table can leave vdd_dep_on_sclk, vdd_dep_on_mclk, or mm_dep_table NULL so the ->count load oopses; garbage voltages later sent to the SMU can hang the GPU."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c"],"versions":[{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"d9ef085114d1e3c2c1f869c0bdb275a7b358ce8b","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"6f08c001fa6e8212930d694540ae8d9d6d3fb58a","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"ce0d8e72836c9d3710a160ad848b0f1d096075e3","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"745297208d31222f916cc04da313cb737b997935","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"f925d317d84d401d642e537ea18ee12f67cb6983","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"8a3db9f593b643904c6cc6d8a3f211c84ca6cf8a","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"1664327ce797e09e387dc10cbbaa5b8d76558d2c","status":"affected","versionType":"git"},{"version":"c82baa28184356a75c0157129f88af42b2e7b695","lessThan":"3a8a05477cda6c8293e2b629495b42981dcaba32","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c"],"versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","status":"unaffected","versionType":"semver"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.10.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"5.15.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.1.188"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.6.157"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.12.110"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"6.18.52"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.5","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d9ef085114d1e3c2c1f869c0bdb275a7b358ce8b"},{"url":"https://git.kernel.org/stable/c/6f08c001fa6e8212930d694540ae8d9d6d3fb58a"},{"url":"https://git.kernel.org/stable/c/ce0d8e72836c9d3710a160ad848b0f1d096075e3"},{"url":"https://git.kernel.org/stable/c/745297208d31222f916cc04da313cb737b997935"},{"url":"https://git.kernel.org/stable/c/f925d317d84d401d642e537ea18ee12f67cb6983"},{"url":"https://git.kernel.org/stable/c/8a3db9f593b643904c6cc6d8a3f211c84ca6cf8a"},{"url":"https://git.kernel.org/stable/c/1664327ce797e09e387dc10cbbaa5b8d76558d2c"},{"url":"https://git.kernel.org/stable/c/3a8a05477cda6c8293e2b629495b42981dcaba32"}],"title":"drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup","x_generator":{"engine":"bippy-1.2.0"}}}}