VulnerabilityPublished 24 Sep 2026Updated 30 Oct 2026

CVE-2026-97425: Linux kernel · drm/amdgpu: fix buffer overflow during vBIOS update

Source GCVE Database

Compare

Authoritative record:CVE-2026-97425· High

Not known to be exploited · fixed in c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992 : patch Linux kernel soon.

Data as of 30 Oct 2026, 16:33 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992, bce28deb42b9e8d368648a002ffe3a6124c482aa, 6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-pv43-wh94-fv25

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 8424f2ccb3c0dd43369288a47d15c980136c3bd5, < c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992	Fixed in c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992
LinuxLinux	Affected ≥ 8424f2ccb3c0dd43369288a47d15c980136c3bd5, < bce28deb42b9e8d368648a002ffe3a6124c482aa	Fixed in bce28deb42b9e8d368648a002ffe3a6124c482aa
LinuxLinux	Affected ≥ 8424f2ccb3c0dd43369288a47d15c980136c3bd5, < 6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5	Fixed in 6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5
LinuxLinux	Affected ≥ 8424f2ccb3c0dd43369288a47d15c980136c3bd5, < 29fef371331e87311822000535f491ffc3d7a64f	Fixed in 29fef371331e87311822000535f491ffc3d7a64f
LinuxLinux	Affected ≥ 8424f2ccb3c0dd43369288a47d15c980136c3bd5, < 4a1b0a4c5acbe96368d71157b264dcd917ba6c9e	Fixed in 4a1b0a4c5acbe96368d71157b264dcd917ba6c9e
LinuxLinux	Affected =5.19	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds accessing.

References

Community reviews

Loading reviews…