CVE-2026-97425

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. The driver fails to enforce maximum size limits on the sysfs interface used for updating the video Basic Input/Output System (vBIOS). A local user with write access to the device interface could exploit this flaw by sending data exceeding expected boundaries, causing an out-of-bounds write that leads to memory corruption or a denial of service (DoS).

This vulnerability is assessed as Moderate impact by Red Hat because exploitation demands local system access on physical hosts equipped with AMD graphics hardware, restricting the attack surface away from unauthenticated network vectors. Typical Red Hat Enterprise Linux server environments do not deploy discrete AMD display controllers, limiting exposure primarily to specialized workstation installations or dedicated compute workloads. Furthermore, the vulnerability cannot be triggered remotely and relies on write access to device-specific administrative endpoints.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.