CVE-2026-93177

A flaw was found in the Linux kernel's AMD GPU powerplay module. This vulnerability arises from missing bounds checks when processing voltage indices from VBIOS-parsed tables. An attacker could potentially exploit this by providing specially crafted VBIOS data, leading to an out-of-bounds read. This could result in system instability or a denial of service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local access and the presence of specific AMD Vega10 hardware, restricting the blast radius to a local denial of service. In typical Red Hat Enterprise Linux server environments where dedicated AMD graphics processors are absent or uninitialized, systems are not exposed to this condition. Triggering the flaw requires supplying malformed video BIOS data during power management initialization, preventing unauthorized privilege escalation or remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.