CVE-2026-64097
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
19/07/2026
Última modificación:
20/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/amd/display: Validate GPIO pin LUT table size before iterating<br />
<br />
[Why&How]<br />
The GPIO pin table parsers in get_gpio_i2c_info() and<br />
bios_parser_get_gpio_pin_info() derive an element count from the VBIOS<br />
table_header.structuresize field, then iterate over gpio_pin[] entries.<br />
However, GET_IMAGE() only validates that the table header itself fits<br />
within the BIOS image. If the VBIOS reports a structuresize larger than<br />
the actual mapped data, the loop reads past the end of the BIOS image,<br />
causing an out-of-bounds read.<br />
<br />
Fix this by calling bios_get_image() to validate that the full claimed<br />
structuresize is accessible within the BIOS image before entering the<br />
loop in both functions.<br />
<br />
(cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)
Impacto
Puntuación base 3.x
7.80
Gravedad 3.x
ALTA
Referencias a soluciones, herramientas e información
- https://git.kernel.org/stable/c/67461e0c15335894cc5d3b84cda823bf8cbdc886
- https://git.kernel.org/stable/c/7ca695b3122297b06a3ed605bbe1cd32c85d9f5a
- https://git.kernel.org/stable/c/86d2b20644b11d21fe52c596e6e922b4590a3e3f
- https://git.kernel.org/stable/c/9900f6954be779011e7c2cd42addd87baf028bc5
- https://git.kernel.org/stable/c/f2a4827e980ba07de4391fa84d9c39a12726bdd7
- https://git.kernel.org/stable/c/fb30a3890d62fd50a95aef684faf64a307592e42



