Description

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with fru_pia_advance() and fru_pia_copy_field() helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on truncated or malformed FRU data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-24T17:17:20.797Z",
  "pubdate": "2026-09-24T17:17:20.797Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) read condition within the Linux kernel's amdgpu driver related to the parsing of Field Replaceable Unit (FRU) Product Information Area (PIA) data.\nThe flaw stems from an insecure, open-coded Type-Length-Value (TLV) walk implementation that fails to adequately validate input lengths against the provided EEPROM data buffer.\nAn attacker capable of influencing the EEPROM data on a target AMD GPU could trigger an OOB read, potentially resulting in kernel memory information disclosure or system instability.\nThe vulnerability affects the amdgpu driver subsystem. Successful exploitation typically requires local access or the ability to manipulate hardware-level EEPROM data, which may be restricted depending on the system configuration and hardware interface accessibility.\nThe risk is mitigated by enforcing strict bounds checking during the parsing process, ensuring that all data access remains within the allocated memory boundaries of the EEPROM data structure.",
  "technicalDetails": "The root cause of this vulnerability lies in the manual and unbounded parsing logic employed when reading FRU PIA data from the device EEPROM. The amdgpu driver previously utilized an open-coded TLV (Type-Length-Value) walking mechanism that did not verify whether the length fields contained within the data headers corresponded to the actual remaining capacity of the buffer.\nIn a standard TLV parsing routine, the parser reads the 'Type' and 'Length' fields and then advances an internal pointer or index to read the 'Value' field. If the 'Length' field is intentionally malformed—specifically, if it specifies a size larger than the remaining buffer space—the subsequent read operation will access memory addresses outside the intended data structure.\nThis behavior constitutes an out-of-bounds read. Because the amdgpu driver performs these operations in kernel space, such an access could lead to the leakage of sensitive adjacent kernel memory, potentially exposing cryptographic keys, function pointers, or other critical data structures to an attacker-controlled user-space process.\nThe exploitation flow begins with the attacker supplying or inducing a malformed FRU PIA image in the hardware EEPROM. When the driver attempts to initialize or query the device status, it invokes the vulnerable parsing routine. By exploiting the lack of bounds checking, the driver reads past the end of the input buffer.\nTo resolve this, the developers replaced the custom, unbounded walk logic with dedicated helper functions: fru_pia_advance() and fru_pia_copy_field(). These helpers are designed to validate the length of each field against the actual total size of the EEPROM data before performing any copy or traversal operations. By ensuring that every read operation is strictly constrained by the total buffer size, the kernel prevents the parser from overrunning the memory boundary.\nThe vulnerability is primarily a memory safety issue within the Linux kernel drivers. It does not necessarily require network exposure but relies on the ability to interact with the hardware's management interfaces or the ability to modify the contents of the physical EEPROM on the affected GPU."
}