Linux Kernel EUVD-2026-86041

Exploitation requires the amdgpu driver to parse FRU (Field Replaceable Unit) EEPROM data on an AMD GPU that exposes a FRU PIA - primarily datacenter/professional AMD GPUs, not all consumer cards. The OOB read only triggers when the FRU PIA TLV data is truncated or malformed, meaning an attacker must control or corrupt the on-board EEPROM contents (malicious/faulty device or physical/privileged EEPROM reflash) rather than send network or userspace input. LIMITING FACTORS: local vector only (no network reach), the affected FRU-parsing code path must be present and exercised at driver init, and the practical outcome is a driver crash rather than reliable code execution or data theft; there is no user-interaction-based remote trigger.

This is a defensive-hardening fix for an out-of-bounds read (CWE-125) in the Linux amdgpu FRU PIA (Product Info Area) TLV parser, where an open-coded walk read past the actual EEPROM data length on truncated or malformed FRU data. The input CVSS vector (AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:H, 7.7) reads high, but the signal set argues for a materially lower real-world priority. There is no EPSS score, no CISA KEV listing, and no public exploit - exploitation status is 'no public exploit identified at time of analysis.' Crucially, the description shows this parses hardware EEPROM contents at driver init, so the CVSS PR:N/AC:L combination is questionable: triggering the OOB read realistically requires malformed FRU data on the device EEPROM, which implies a malicious/faulty GPU or physical EEPROM reflash rather than an easy unprivileged software path. The C:H claim also looks overstated - a bounded over-read of small FRU fields is far more likely to cause a crash (A:H) than meaningful kernel-memory disclosure, so C:L is more defensible. Net: a legitimate latent robustness bug, but not a widespread-exploitation priority. CONFLICT TO VERIFY: CVSS says AC:L/PR:N against default config, yet the code path only fires on attacker-influenced EEPROM/FRU content - treat this as local, high-complexity, and not remotely reachable.

An attacker who can supply malformed or truncated FRU EEPROM data to an AMD GPU (e.g., a tampered/faulty device or an EEPROM reflash with physical or privileged local access) causes the amdgpu driver's FRU PIA parser to read past the end of the EEPROM buffer during initialization. The most likely outcome is a kernel crash / denial of service, with a theoretical chance of reading adjacent kernel memory. No public exploit or PoC is available.