In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and… (CVE-2026-93178)
A high-severity vulnerability in the Linux kernel's AMDGPU driver was resolved. The issue involved the drm/amdgpu/pm/powerplay component where voltage index fields (vddInd and vddcInd) from VBIOS-parsed tables were used to index voltage lookup tables without proper bounds checking. This could lead to invalid memory access. The fix adds a check to return an error (-EINVAL) when an index is out of range.
AI Analysis
Technical Summary
The Linux kernel AMDGPU driver had a vulnerability in the drm/amdgpu/pm/powerplay code where the vddInd and vddcInd fields from VBIOS-parsed tables were used as indices into voltage lookup tables without verifying that these indices were within valid bounds. This lack of bounds checking could cause out-of-bounds memory access. The vulnerability was addressed by adding a bounds check that returns -EINVAL if any index is out of range, preventing invalid indexing.
Potential Impact
Improper bounds checking could allow an attacker with local privileges to cause denial of service (kernel crash) or potentially escalate privileges due to memory corruption. The CVSS score of 7.1 reflects high severity with high confidentiality impact and high availability impact but no integrity impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add bounds checking on voltage indices in the AMDGPU driver. Users should update their Linux kernel to a version that includes this patch. Since no specific fixed versions are provided, consult the vendor or kernel release notes for the patch availability. No additional mitigation is indicated.
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and… (CVE-2026-93178)
Description
A high-severity vulnerability in the Linux kernel's AMDGPU driver was resolved. The issue involved the drm/amdgpu/pm/powerplay component where voltage index fields (vddInd and vddcInd) from VBIOS-parsed tables were used to index voltage lookup tables without proper bounds checking. This could lead to invalid memory access. The fix adds a check to return an error (-EINVAL) when an index is out of range.
CVSS v3.1
Score 7.1high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel AMDGPU driver had a vulnerability in the drm/amdgpu/pm/powerplay code where the vddInd and vddcInd fields from VBIOS-parsed tables were used as indices into voltage lookup tables without verifying that these indices were within valid bounds. This lack of bounds checking could cause out-of-bounds memory access. The vulnerability was addressed by adding a bounds check that returns -EINVAL if any index is out of range, preventing invalid indexing.
Potential Impact
Improper bounds checking could allow an attacker with local privileges to cause denial of service (kernel crash) or potentially escalate privileges due to memory corruption. The CVSS score of 7.1 reflects high severity with high confidentiality impact and high availability impact but no integrity impact. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to add bounds checking on voltage indices in the AMDGPU driver. Users should update their Linux kernel to a version that includes this patch. Since no specific fixed versions are provided, consult the vendor or kernel release notes for the patch availability. No additional mitigation is indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-fw9r-626q-5x54
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-93178"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aade51555bf5e2cf5edc01c
Added to database: 09/19/2026, 01:27:49 UTC
Last enriched: 09/19/2026, 01:42:20 UTC
Last updated: 09/19/2026, 01:42:20 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.