Skip to main content

Linux Kernel CVE-2026-64097

| EUVDEUVD-2026-45782 HIGH
Out-of-bounds Write (CWE-787)
2026-07-19 Linux GHSA-78vx-v25w-4237
Buffer Overflow Linux Memory Corruption Amd
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
3.0 LOW

Out-of-bounds read reachable only via a crafted VBIOS, which needs firmware-flash/admin access (PR:H) and non-default malformed firmware (AC:H); a read yields limited disclosure and possible crash, so C:L/I:N/A:L.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:25 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Validate GPIO pin LUT table size before iterating

[Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read.

Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions.

(cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)

AnalysisAI

Out-of-bounds read in the AMD display (amdgpu) driver of the Linux kernel occurs when the GPIO pin table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() trust the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without confirming the full claimed size is mapped. On a system with a malformed or oversized VBIOS structuresize, the loop reads past the end of the BIOS image, potentially disclosing adjacent kernel memory or crashing the driver. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and the issue is not listed in CISA KEV; a vendor patch is available across multiple stable trees.

Technical ContextAI

The affected code is in AMD's Display Core BIOS parser within the Linux kernel's drm/amd/display subsystem. During initialization the driver reads the AMD Video BIOS (VBIOS/ATOM) tables to discover GPIO pin assignments for I2C and other display connectivity. The element count for the gpio_pin[] array is derived from the VBIOS-provided table_header.structuresize, but GET_IMAGE() only validated that the header itself fit within the mapped BIOS image, not that the entire declared structure was accessible. This is a classic out-of-bounds read (CWE-125, consistent with the 'Buffer Overflow' tag; the input CWE field is N/A) rooted in trusting attacker-influenced length metadata before bounds-checking the backing buffer. The fix adds a bios_get_image() call to validate the full structuresize is within the image before the iteration.

RemediationAI

Vendor-released patch: upgrade the Linux kernel to a fixed version for your series - 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1 or later - via your distribution's stable kernel updates. The fix (cherry-picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3, backported in the stable commits at https://git.kernel.org/stable/c/9900f6954be779011e7c2cd42addd87baf028bc5) adds a bios_get_image() bounds check before iterating the GPIO pin table. Because the bug is only reachable through the AMD VBIOS parser, an interim compensating control on non-AMD or headless systems is to avoid loading the amdgpu driver (blacklist the module where no AMD display is required), though this disables AMD graphics/display functionality entirely; on affected AMD systems the practical control is to restrict firmware-flashing capability and physical access so a malicious VBIOS cannot be introduced. Refer to the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-64097.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64097 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy