Out-of-bounds read in Linux kernel - CVE-2026-93177
Published: September 18, 2026
Vulnerability identifier: #VU150822
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93177
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read out-of-bounds memory.
The vulnerability exists due to an out-of-bounds read in the Vega10 PowerPlay hardware manager when parsing VBIOS-provided voltage dependency tables. A local user can provide voltage table entries containing out-of-range lookup indices to read out-of-bounds memory.
Affected software
Linux kernel
How to mitigate CVE-2026-93177
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/06aef6dcc1d52da5112cbcde39c062e493247ab5
- https://git.kernel.org/stable/c/206e478810d6af50b25d8da72e3af8d55a014365
- https://git.kernel.org/stable/c/25dedc13ceb9b6109c79c92a726ca4ca017c9eaa
- https://git.kernel.org/stable/c/46d27e56dbd6345b9c7b62b67ec57407bf3bf29a
- https://git.kernel.org/stable/c/6fa33f594e46e775a94097f71b486d7b006b6917
- https://git.kernel.org/stable/c/ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b
- https://git.kernel.org/stable/c/b349dcf061a6dc8c6cef9a10530331ef2ff66c72
- https://git.kernel.org/stable/c/dfe89f1a0c7f40ef858b93881198f9728df956cf