The Linux kernel AMD display driver contained unbounded loops in bios_parser.c and bios_parser2.c that walk through VBIOS record chains. These loops relied on sentinel values (0xFF record_type or zero record_size) to terminate. A malformed VBIOS image lacking these terminators could cause the loops to iterate excessively, potentially hundreds of thousands of times with minimal record sizes, leading to out-of-bounds memory reads near the BIOS image boundary. The vulnerability was addressed by capping all 14 record-chain walk loops to a maximum of 256 iterations, a value chosen based on the number of distinct record types and typical record counts per type. This change prevents unbounded iteration and associated memory safety issues.

An attacker could supply a malformed VBIOS image that causes the AMD display driver's record-chain parsing loops to execute unbounded iterations, potentially leading to out-of-bounds memory reads. This could cause system instability, crashes, or other undefined behavior during kernel probe time. No known exploits are reported in the wild. The impact is primarily a denial of service or potential memory corruption during device initialization.

A fix has been implemented in the Linux kernel by bounding the record-chain walk loops to 256 iterations. Users should update to a Linux kernel version that includes commit 95700a3d660287ed657d6892f7be9ffc0e294a93 or later. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.