Linux Kernel EUVD-2026-82286

Requires an AMD GPU using the SMU7 powerplay path (GCN-generation cards such as Tonga/Fiji/Polaris) and a VBIOS whose voltage tables contain an out-of-range vddInd or vddcInd value. The malicious/malformed values must be present in VBIOS-parsed firmware tables, so exploitation depends on the ability to supply or flash crafted GPU firmware - not on ordinary runtime input - which typically requires privileged or physical access. Limiting factors: local access only (AV:L), no remote/network path, no user interaction, and the trigger is confined to driver/powerplay initialization parsing firmware data rather than an attacker-facing interface. Default configurations with a legitimate vendor VBIOS are not exploitable.

This is a high-CVSS-but-modest-real-risk issue. The vendor CVSS is 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), but the vector overstates the practical threat. The out-of-bounds read stems from vddInd/vddcInd fields sourced from VBIOS-parsed tables - firmware data, not runtime attacker-controlled input. Influencing those indices requires supplying a malformed/malicious VBIOS, which normally demands firmware-flash capability (privileged or physical access), so AC:L/PR:L understates the real requirement (closer to AC:H, effectively PR:H/physical). Impact is a bounded OOB read of a small voltage lookup array at powerplay/driver init - crash-primary DoS with at most marginal information disclosure, so C:H is generous. No EPSS score, no CISA KEV listing, and no public exploit are present in the data; exploitation status is no public exploit identified at time of analysis. SSVC-style: exploitation none, not automatable (local firmware-dependent trigger), technical impact partial. Net: real-world priority is LOW despite the 7.1 label. Note the CVSS says AV:L while the data-flow (VBIOS parsing) implies firmware/privileged control rather than ordinary local-user access - verify the trust model with the vendor.

An attacker with the ability to flash or supply a crafted VBIOS (e.g., a malicious/corrupt GPU firmware image on an AMD SMU7-class card) sets an out-of-range vddInd/vddcInd value in a VBIOS voltage table. When the amdgpu powerplay code parses the table and indexes the voltage lookup array during initialization, it reads out of bounds, crashing the driver/kernel (DoS). No public exploit or POC is identified for this issue.