CVE-2026-93177 (GCVE-0-2026-93177)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:12 – Updated: 2026-09-18 17:56
VLAI
Title
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f83a9991648bb4023a53104db699e99305890d51 , < 206e478810d6af50b25d8da72e3af8d55a014365 (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < 25dedc13ceb9b6109c79c92a726ca4ca017c9eaa (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < b349dcf061a6dc8c6cef9a10530331ef2ff66c72 (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < dfe89f1a0c7f40ef858b93881198f9728df956cf (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < 46d27e56dbd6345b9c7b62b67ec57407bf3bf29a (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < 06aef6dcc1d52da5112cbcde39c062e493247ab5 (git)
Affected: f83a9991648bb4023a53104db699e99305890d51 , < 6fa33f594e46e775a94097f71b486d7b006b6917 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.110 , ≤ 6.12.* (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "206e478810d6af50b25d8da72e3af8d55a014365",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "25dedc13ceb9b6109c79c92a726ca4ca017c9eaa",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "b349dcf061a6dc8c6cef9a10530331ef2ff66c72",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "dfe89f1a0c7f40ef858b93881198f9728df956cf",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "46d27e56dbd6345b9c7b62b67ec57407bf3bf29a",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "06aef6dcc1d52da5112cbcde39c062e493247ab5",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            },
            {
              "lessThan": "6fa33f594e46e775a94097f71b486d7b006b6917",
              "status": "affected",
              "version": "f83a9991648bb4023a53104db699e99305890d51",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup\n\nvddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc,\nvddci and vddmem lookup tables without bounds checks across nine sites.\nReturn -EINVAL when any index is out of range."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Writing a crafted ATOM Vega10 POWERPLAYTABLE to sysfs pp_table (amdgpu_set_pp_table \u2192 pp_dpm_set_pp_table \u2192 amd_powerplay_reset \u2192 hwmgr_hw_init) makes vega10_pp_tables_initialize copy ucVddInd/ucVddciInd/ucVddMemInd into vddInd; vega10_hwmgr_backend_init then calls vega10_patch_voltage_dependency_tables_with_lookup_table. No network protocol carries those indices.\nAC:L - The attacker fully controls ucVddInd in each ATOM_Vega10 dependency-table entry they write; get_socclk_voltage_dependency_table and get_mclk_voltage_dependency_table copy it verbatim into vddInd, and the unguarded entries[voltage_id].us_vdd load in vega10_patch_voltage_dependency_tables_with_lookup_table is deterministic with no race or victim state.\nPR:L - amdgpu_set_pp_table and pp_dpm_set_pp_table perform no capable() check; the pp_table attribute is created as S_IRUGO|S_IWUSR, and AMD desktop/handheld udev rules commonly grant group write on pp_* nodes so unprivileged overclocking tools can use them (same attribute scored PR:L in CVE-2025-21780 and CVE-2026-74450).\nUI:N - The attacker writes the malformed POWERPLAYTABLE on their own pp_table sysfs node and amd_powerplay_reset runs in that store; no other user must mount a filesystem, plug in a GPU, or open a file.\nS:U - The OOB us_vdd load and later convert_to_vid SMC programming stay inside the host amdgpu powerplay heap and Vega10 SMU tables; they do not cross a KVM/IOMMU guest-host boundary (pp_table writes are rejected for SR-IOV VFs by amdgpu_dpm_is_pp_table_allowed).\nC:H - voltage_id is a uint8_t taken from vddInd, so entries[voltage_id].us_vdd in vega10_patch_voltage_dependency_tables_with_lookup_table reads two bytes at an attacker-chosen offset of up to 255*sizeof(phm_ppt_v1_voltage_lookup_record) (~2.5KB) past a vddc_lookup_table that get_vddc_lookup_table allocated for only 8 entries (4 for vddci/vddmem).\nI:L - The OOB us_vdd is written only into in-bounds vddc/vddci/mvdd fields and later turned into SMC VIDs by convert_to_vid in vega10_populate_single_display_type and vega10_get_vdd_voltage_table, programming out-of-spec GPU rails. That is bounded power-management state corruption, not an arbitrary kernel write.\nA:H - A ~2.5KB heap overread from the kmalloc-flex lookup table can oops or KASAN-panic, and garbage millivolts converted to VID and loaded into Vega10 PPTable_t DisplayClockTable via vega10_populate_single_display_type can hang or reset the GPU."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:56:23.480Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/206e478810d6af50b25d8da72e3af8d55a014365"
        },
        {
          "url": "https://git.kernel.org/stable/c/25dedc13ceb9b6109c79c92a726ca4ca017c9eaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b349dcf061a6dc8c6cef9a10530331ef2ff66c72"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfe89f1a0c7f40ef858b93881198f9728df956cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/46d27e56dbd6345b9c7b62b67ec57407bf3bf29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/06aef6dcc1d52da5112cbcde39c062e493247ab5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fa33f594e46e775a94097f71b486d7b006b6917"
        }
      ],
      "title": "drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93177",
    "datePublished": "2026-09-17T16:12:05.955Z",
    "dateReserved": "2026-09-17T16:02:15.091Z",
    "dateUpdated": "2026-09-18T17:56:23.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-93177",
      "date": "2026-09-25",
      "epss": "0.00167",
      "percentile": "0.05248"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:38:21.000Z",
      "cve": "CVE-2026-93177",
      "id": "msrc_CVE-2026-93177",
      "initial_release_date": "2026-09-19T01:13:38.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-93177.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "206e478810d6af50b25d8da72e3af8d55a014365",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25dedc13ceb9b6109c79c92a726ca4ca017c9eaa",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b349dcf061a6dc8c6cef9a10530331ef2ff66c72",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dfe89f1a0c7f40ef858b93881198f9728df956cf",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "46d27e56dbd6345b9c7b62b67ec57407bf3bf29a",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "06aef6dcc1d52da5112cbcde39c062e493247ab5",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6fa33f594e46e775a94097f71b486d7b006b6917",
                    "status": "affected",
                    "version": "f83a9991648bb4023a53104db699e99305890d51",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup\n\nvddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc,\nvddci and vddmem lookup tables without bounds checks across nine sites.\nReturn -EINVAL when any index is out of range."
          }
        ],
        "id": "CVE-2026-93177",
        "lastModified": "2026-09-18T18:18:23.783",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:18:13.500",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/06aef6dcc1d52da5112cbcde39c062e493247ab5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/206e478810d6af50b25d8da72e3af8d55a014365"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25dedc13ceb9b6109c79c92a726ca4ca017c9eaa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/46d27e56dbd6345b9c7b62b67ec57407bf3bf29a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6fa33f594e46e775a94097f71b486d7b006b6917"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b349dcf061a6dc8c6cef9a10530331ef2ff66c72"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dfe89f1a0c7f40ef858b93881198f9728df956cf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.