CVE-2026-97428

A flaw was found in the Linux kernel's AMDGPU driver. During the parsing of Field Replaceable Unit (FRU) data from EEPROM, the driver does not properly validate boundaries against the actual data length. An attacker capable of supplying truncated or malformed FRU data can trigger an out-of-bounds read. This can lead to a Denial of Service (DoS) via a kernel crash or unauthorized information disclosure.

A moderate-impact out-of-bounds read flaw was found in the Linux kernel's AMDGPU driver, affecting the kernel in Red Hat Enterprise Linux 8, 9 and 10, RHEL CoreOS as shipped with OpenShift 4.16 and later, and RHIVOS. While parsing the Field Replaceable Unit (FRU) Product Info Area (PIA) from the card's EEPROM, the driver performed an open-coded TLV walk that did not bound individual reads against the actual EEPROM data length. An attacker able to supply truncated or malformed FRU data -- which requires prior local privileged or physical access to manipulate the EEPROM contents -- could trigger an out-of-bounds read, causing a kernel crash (denial of service) or disclosing adjacent kernel memory through FRU fields exposed via sysfs. Red Hat rates this flaw moderate severity (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local privileged access; the CVE.org record assigns a higher important score (7.7) by assuming no privileges are required and a high confidentiality impact, which overstates the practical attack preconditions. Earlier Red Hat product versions, including RHEL 7, the RHEL 8.4/8.6/8.8 and 9.2 update streams, and OpenShift 4.12 through 4.15, are not affected because the vulnerable code is not present in those kernels, and RHEL 6 is out of support scope. Fixes for the affected streams are currently deferred: because successful exploitation presupposes that the attacker already controls the FRU EEPROM contents through privileged or physical access, the residual risk of deferring the fix is limited to a local denial of service or limited information disclosure on systems where such access already exists.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.