CVE-2026-93178

A flaw was found in the Linux kernel's drm/amdgpu/pm/powerplay component. This vulnerability arises because the vddInd and vddcInd fields, derived from VBIOS-parsed tables, are used to index into voltage lookup tables without proper boundary checks. A local attacker could exploit this by providing malformed VBIOS data, potentially causing an out-of-bounds read. This could lead to system instability or a denial of service (DoS).

Moderate severity is assigned to this issue because exploitation requires local access and is limited to systems equipped with AMD graphics hardware driven by the amdgpu powerplay SMU7 subsystem. While an attacker with sufficient local privileges could trigger an out-of-bounds read by supplying malformed firmware tables, the impact is confined to a denial of service via a kernel crash without arbitrary code execution. Standard Red Hat Enterprise Linux server environments lacking AMD GPU hardware remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.