{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97428", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T14:53:16.868Z", "datePublished": "2026-09-24T16:03:41.103Z", "dateUpdated": "2026-10-21T12:52:46.339Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:52:46.339Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed IPMI FRU Product Info Area TLV lengths (pia[addr] & 0x3F) are consumed by amdgpu_fru_get_product_info() after amdgpu_eeprom_read() on adev->pm.fru_eeprom_i2c_bus, reached from amdgpu_pci_probe() \u2192 amdgpu_driver_load_kms() \u2192 amdgpu_device_init() \u2192 amdgpu_device_ip_init(). Those bytes come from the GPU I2C FRU EEPROM, not a network protocol or USB descriptor.\nAC:L - A FRU image with valid Common Header and PIA checksums but TLV lengths that extend past the kmalloc'd pia buffer makes the pre-fix memcpy of manufacturer_name, product_name, product_number, serial, and fru_id overread on every probe. The attacker programs those EEPROM bytes; skipped Product Version/Asset Tag advances also lack a bounds check. No race.\nPR:N - amdgpu_fru_get_product_info() runs from amdgpu_device_ip_init() during amdgpu_pci_probe() with no capable() or credential check. is_fru_eeprom_supported() only matches server SKUs (Vega20 D161/D163, Aldebaran, SMU 13.0.6/13.0.14) and skips SR-IOV VFs and APUs; a crafted FRU on a supported GPU is parsed without a host account.\nUI:N - amdgpu_pci_probe() calls amdgpu_fru_get_product_info() automatically while binding a supported AMD server GPU; no victim must open a DRM node, mount media, or write sysfs.\nS:U - The memcpy overread of the kzalloc'd pia buffer and the later 0444 sysfs emit stay in this host kernel's amdgpu driver. is_fru_eeprom_supported() returns false for amdgpu_sriov_vf(), so this is not a guest-to-host or IOMMU boundary crossing.\nC:H - Pre-fix memcpy(fru_info->product_name, pia+addr+1, min(64, pia[addr]&0x3F)) and the manufacturer_name/product_number/serial/fru_id copies do not cap the length to remaining PIA bytes, so a 6-bit length near the end of pia reads up to 63 bytes of adjacent kernel heap. amdgpu_fru_product_name_show and sibling 0444 attributes then emit those fields; that is not a few-byte leak.\nI:N - Each memcpy destination is min'd against sizeof(fru_info->manufacturer_name/product_name/product_number/serial/fru_id), so the TLV walk does not write past those arrays or other kernel objects. This path has no out-of-bounds write or control-flow hijack primitive.\nA:H - A short PIA (size = buf[1]*8, e.g. 8 bytes) plus a product_name field length of 63 makes memcpy() walk tens of bytes past the kzalloc'd pia object into unmapped or poisoned slab and oops inside amdgpu_fru_get_product_info() during probe."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"], "versions": [{"version": "0dbf2c56262532fbd498f590c91c4085413b8829", "lessThan": "567d7c3f93f8d6bdc946a557a160ee1c42cfae91", "status": "affected", "versionType": "git"}, {"version": "0dbf2c56262532fbd498f590c91c4085413b8829", "lessThan": "813311512505e95e4e3c898ff94b11886a15e494", "status": "affected", "versionType": "git"}, {"version": "0dbf2c56262532fbd498f590c91c4085413b8829", "lessThan": "4396d74b0c7304946ee343a6611ac6dbc0bfbf78", "status": "affected", "versionType": "git"}, {"version": "0dbf2c56262532fbd498f590c91c4085413b8829", "lessThan": "c990c05eb6c74c98d1ff3acf67a19015312820b7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/567d7c3f93f8d6bdc946a557a160ee1c42cfae91"}, {"url": "https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494"}, {"url": "https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78"}, {"url": "https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7"}], "title": "drm/amdgpu: harden FRU PIA parsing with bounded helpers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "567d7c3f93f8d6bdc946a557a160ee1c42cfae91", "status": "affected", "version": "0dbf2c56262532fbd498f590c91c4085413b8829", "versionType": "git"}, {"lessThan": "813311512505e95e4e3c898ff94b11886a15e494", "status": "affected", "version": "0dbf2c56262532fbd498f590c91c4085413b8829", "versionType": "git"}, {"lessThan": "4396d74b0c7304946ee343a6611ac6dbc0bfbf78", "status": "affected", "version": "0dbf2c56262532fbd498f590c91c4085413b8829", "versionType": "git"}, {"lessThan": "c990c05eb6c74c98d1ff3acf67a19015312820b7", "status": "affected", "version": "0dbf2c56262532fbd498f590c91c4085413b8829", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."}], "id": "CVE-2026-97428", "lastModified": "2026-10-21T13:21:09.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-24T17:17:20.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/567d7c3f93f8d6bdc946a557a160ee1c42cfae91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: harden FRU PIA parsing with bounded helpers", "id": "2540406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540406"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data.", "A flaw was found in the Linux kernel's AMDGPU driver. During the parsing of Field Replaceable Unit (FRU) data from EEPROM, the driver does not properly validate boundaries against the actual data length. An attacker capable of supplying truncated or malformed FRU data can trigger an out-of-bounds read. This can lead to a Denial of Service (DoS) via a kernel crash or unauthorized information disclosure."], "name": "CVE-2026-97428", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97428\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97428\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97428.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,813311512505e95e4e3c898ff94b11886a15e494)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4396d74b0c7304946ee343a6611ac6dbc0bfbf78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c990c05eb6c74c98d1ff3acf67a19015312820b7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-24T22:45:18.537689+00:00", "updated": "2026-09-26T01:45:03.056088+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-125"]}