What is the CVSS score of CVE-2026-93177?

CVE-2026-93177 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-93177?

Within 24 hours, inventory Linux systems with AMD Vega10 GPUs and confirm kernel versions, then apply the vendor patch; Patch available per vendor advisory in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.x stable branches, or update to the latest patched kernel from your distribution. Within 7 days, prioritize remediation for multi-user, virtualized, or high-availability hosts where local users or corrupted firmware could trigger the out-of-bounds reads, and verify successful patching through configuration management or vulnerability scanning. Within 30 days, validate all Vega10 GPU hosts against the vendor advisory, enforce firmware integrity controls for VBIOS/PowerPlay tables, and monitor for kernel crashes or anomalous memory disclosure attempts.

Linux Kernel CVE-2026-93177

Q: Which versions of Linux Kernel are affected by CVE-2026-93177?

A high-severity flaw in the Linux kernel's AMDGPU PowerPlay driver for Vega10 GPUs can crash affected systems and potentially disclose kernel memory, impacting organizations that run these GPUs in…. A patch is available.

EUVD-2026-82285 HIGH

2026-09-17 Linux

GHSA-28gw-3rjm-8334

Information Disclosure Linux Suse

7.3

CVSS 3.1 · Vendor: Linux

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local privileged access to GPU init
Delivery

Supply malformed VBIOS voltage table
Exploit

Out-of-range index used in Vega10 lookup
Execution

OOB read of kernel memory
Impact

Kernel crash or state leak (DoS)

Vulnerability Assessment

Exploitation Conditions	Requires an AMD Vega10-based GPU whose VBIOS-parsed voltage lookup tables (vddc/vddci/vddmem) contain out-of-range vddInd/vddciInd/mvddInd values; the bug is reached during powerplay voltage-table processing at driver init. Exploitation is LIMITED by needing control over or corruption of the VBIOS/firmware tables (not a normal unprivileged local input), local access, and presence of the specific Vega10 hardware - it is not remotely reachable and not triggerable against a stock, uncorrupted firmware configuration.
Impact	The vendor CVSS is 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), a local, low-privilege issue with no user interaction. That vector overstates real-world risk. The out-of-bounds indices (vddInd, vddciInd, mvddInd) come from VBIOS-parsed voltage tables, not from an unprivileged attacker-supplied input path - exploitation requires a malformed/crafted VBIOS or corrupted firmware tables, which is not a normal attacker-driven vector on a stock system, so AC:H and PR:H are more honest than AC:L/PR:L. The practical impact is an out-of-bounds READ during Vega10 powerplay initialization, so C:H is inflated; a small kernel-memory leak (C:L) and a crash/hang (A:H) are the realistic outcomes, with no integrity impact. Signals: no EPSS score provided, not in CISA KEV, and no public exploit identified - no public exploit identified at time of analysis. The 'Information Disclosure' tag is defensible because it is genuinely an OOB read, but the dominant effect is DoS via crash. Net: a real defect worth patching but a low-priority, config/firmware-dependent hardware-init bug rather than an urgent, widely-exploitable vulnerability.
Exploit ScenarioDerived	On a system with an AMD Vega10 GPU, a malformed or crafted VBIOS voltage-lookup table supplies an out-of-range vddInd/vddciInd/mvddInd value that the powerplay code uses to index vddc/vddci/vddmem lookup arrays without bounds checking. During driver/powerplay initialization the kernel reads past the array bounds, leaking adjacent kernel memory into voltage state or crashing/hanging the machine. No public exploit is known, and triggering it requires control over the firmware tables or a corrupted VBIOS rather than a remote or unprivileged local input.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Out-of-bounds reads in the Linux kernel's AMDGPU PowerPlay driver for Vega10 GPUs allow kernel memory to be read past the end of the vddc, vddci and vddmem voltage lookup arrays, typically causing a kernel crash and potentially disclosing adjacent memory contents at nine separate lookup sites. Exploitation is limited to local, privileged actors or to systems whose VBIOS/firmware PowerPlay tables have been corrupted, since the offending vddInd, vddciInd and mvddInd values are derived from VBIOS-parsed tables rather than from ordinary unprivileged user input; the vendor rates the issue CVSS 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), while our independent assessment scores it lower (AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H) because reachability requires control over or corruption of the GPU firmware tables plus specific Vega10 hardware. Vendor-released patches are available in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18 and 7.x stable branches, and no public exploit code has been identified at time of analysis; the EPSS/KEV feeds show no confirmed active exploitation. The system fully recovers only after the out-of-range index is rejected with -EINVAL, which is the fix the upstream commits introduce.

RemediationAI

Apply the vendor-released patches by upgrading to the fixed stable kernel for your branch: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 on the maintained LTS/stable streams, or 7.2.6 / 7.3-rc1 on the current development stream; each branch's commit is published at the corresponding git.kernel.org/stable/c/<hash> link and the CVE is indexed at https://nvd.nist.gov/vuln/detail/CVE-2026-93177. Where immediate kernel upgrades are not possible, the practical compensating control is to avoid exercising the affected Vega10 PowerPlay voltage path by booting with the AMDGPU dynamic power management disabled (kernel parameter amdgpu.dpm=0), which prevents the power-management tables from being parsed and indexed - at the cost of losing dynamic clock/power management, higher idle power draw and potentially reduced GPU performance and thermal control. A more drastic option is to blacklist the amdgpu module or force a fallback GPU driver (e.g. vesa/llvmpipe), which removes the attack surface entirely but disables hardware acceleration, Vulkan/OpenCL and multi-monitor GPU features. Because the trigger requires corrupted or attacker-controlled VBIOS/firmware tables, organizations should also enforce firmware integrity for GPU VBIOS (signed firmware enforcement, trusted supply chain for GPU hardware and vendor update tools) and restrict physical/administrative access to machines with Vega10 cards; these are partial mitigations only, as they do not fix the missing bounds checks, and no vendor patch substitutes exist beyond the listed stable upgrades.

Affected VersionsENISA

Linux 4.12

Linux f83a9991648bb4023a53104db699e99305890d51 <b349dcf061a6dc8c6cef9a10530331ef2ff66c72

Linux f83a9991648bb4023a53104db699e99305890d51 <25dedc13ceb9b6109c79c92a726ca4ca017c9eaa

Linux patch: 6.12.110

Linux f83a9991648bb4023a53104db699e99305890d51 <dfe89f1a0c7f40ef858b93881198f9728df956cf

Linux patch: 6.6.157

Linux patch: 7.3-rc1

Linux patch: 7.2.6

Linux f83a9991648bb4023a53104db699e99305890d51 <46d27e56dbd6345b9c7b62b67ec57407bf3bf29a

Linux patch: 5.10.270

Linux patch: 6.18.52

Linux f83a9991648bb4023a53104db699e99305890d51 <206e478810d6af50b25d8da72e3af8d55a014365

Linux patch: 0

Linux f83a9991648bb4023a53104db699e99305890d51 <ae25c92d91f2cb90ede2b0eb0f58efa82ccc718b

Linux f83a9991648bb4023a53104db699e99305890d51 <06aef6dcc1d52da5112cbcde39c062e493247ab5

Linux f83a9991648bb4023a53104db699e99305890d51 <6fa33f594e46e775a94097f71b486d7b006b6917

Linux patch: 6.1.188

Linux patch: 5.15.221

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is the AMDGPU kernel driver's PowerPlay power-management subsystem, specifically the legacy Vega10 (Vega10/Polaris-class SMU) voltage-table handling used during driver initialization. PowerPlay parses voltage and clock tables supplied by the GPU's VBIOS, extracting index fields named vddInd, vddciInd and mvddInd. Those indices are then used to index into three per-rail lookup tables - vddc, vddci and vddmem - which hold the corresponding voltage values. Across nine call sites in the Vega10 lookup code, the indices were dereferenced without validating that they fell inside the bounds of the corresponding table, producing an out-of-bounds read (the CWE-125 / improper-input-validation class; no CWE was supplied in the feed). Because the index values originate from firmware-parsed tables, the root cause is missing validation of externally supplied (VBIOS) configuration data rather than of attacker-controlled syscall arguments; the upstream resolution adds explicit range checks and returns -EINVAL when any index is out of range. Affected CPE data maps to the generic Linux kernel product (cpe:2.3:a:linux:linux), and EUVD records the fix lineage branching from base commit f83a9991648bb4023a53104db699e99305890d51, indicating the flawed lookup logic predates the fixed trees. The primary failure mode is a kernel out-of-bounds read that can panic the driver during modeset/power-management initialization, with a secondary information-disclosure risk from reading memory adjacent to the voltage tables.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

vuln.today AI 4.7 MEDIUM

Indices originate from VBIOS/firmware tables requiring crafted/corrupted input and privileged hardware-init context (AC:H, PR:H); OOB read yields limited leak (C:L) and crash (A:H), no integrity impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

CVSS changed

Sep 18, 2026 - 18:22 NVD

7.3 (HIGH)

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:12 cve.org

UNKNOWN (no severity yet)

CVE Published

Sep 17, 2026 - 16:12 cve.org

HIGH 7.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

vddInd, vddciInd and mvddInd from VBIOS-parsed tables index into vddc, vddci and vddmem lookup tables without bounds checks across nine sites. Return -EINVAL when any index is out of range.

Executive ViewAI

Why It Matters

A high-severity flaw in the Linux kernel's AMDGPU PowerPlay driver for Vega10 GPUs can crash affected systems and potentially disclose kernel memory, impacting organizations that run these GPUs in workstations, servers, or virtualized environments. Exploitation requires local system access or corrupted GPU firmware, so the risk is concentrated where multiple users or untrusted processes share Vega10 hardware; no public exploit identified at time of analysis. Leadership should prioritize patching to prevent downtime and protect sensitive kernel memory.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Low

AMD Vega10-specific GPU powerplay path; niche hardware generation

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +36

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back