Out-of-bounds read in Linux kernel - CVE-2026-97428
Published: September 25, 2026
Vulnerability identifier: #VU152045
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-97428
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to read memory out of bounds.
The vulnerability exists due to improper bounds checking in the AMDGPU FRU EEPROM product information parser when parsing truncated or malformed FRU data. A local user can supply truncated or malformed FRU data to read memory out of bounds.
Affected software
Linux kernel
How to mitigate CVE-2026-97428
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3