CVE-2026-97494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97494", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.150Z", "datePublished": "2026-09-24T16:04:41.957Z", "dateUpdated": "2026-10-30T12:37:04.017Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:04.017Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw\n\nChange psp_copy_fw from void to int: return -ENODEV when drm_dev_enter\nfails, and -EINVAL when the image size is zero or larger than the\n1 MiB PSP private buffer.\n\nReplace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h", "drivers/gpu/drm/amd/amdgpu/psp_v11_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v12_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c", "drivers/gpu/drm/amd/amdgpu/psp_v14_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"], "versions": [{"version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "lessThan": "cb755c29d0fa8fa4b0630bf60cf434c30ffdf0c7", "status": "affected", "versionType": "git"}, {"version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "lessThan": "8ddda06ae356fda0418b7017e658d976dad6214e", "status": "affected", "versionType": "git"}, {"version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "lessThan": "25bec2425c3d50ba9a92ad87bbf8628be29e5c32", "status": "affected", "versionType": "git"}, {"version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "lessThan": "1aa55af304a2decaacca1d1fabe4257c277ca54a", "status": "affected", "versionType": "git"}, {"version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "lessThan": "d1f9f5839bd785a3a06335a01d53282e80f8e5fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h", "drivers/gpu/drm/amd/amdgpu/psp_v11_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v12_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c", "drivers/gpu/drm/amd/amdgpu/psp_v14_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cb755c29d0fa8fa4b0630bf60cf434c30ffdf0c7"}, {"url": "https://git.kernel.org/stable/c/8ddda06ae356fda0418b7017e658d976dad6214e"}, {"url": "https://git.kernel.org/stable/c/25bec2425c3d50ba9a92ad87bbf8628be29e5c32"}, {"url": "https://git.kernel.org/stable/c/1aa55af304a2decaacca1d1fabe4257c277ca54a"}, {"url": "https://git.kernel.org/stable/c/d1f9f5839bd785a3a06335a01d53282e80f8e5fa"}], "title": "drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h", "drivers/gpu/drm/amd/amdgpu/psp_v11_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v12_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c", "drivers/gpu/drm/amd/amdgpu/psp_v14_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cb755c29d0fa8fa4b0630bf60cf434c30ffdf0c7", "status": "affected", "version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "versionType": "git"}, {"lessThan": "8ddda06ae356fda0418b7017e658d976dad6214e", "status": "affected", "version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "versionType": "git"}, {"lessThan": "25bec2425c3d50ba9a92ad87bbf8628be29e5c32", "status": "affected", "version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "versionType": "git"}, {"lessThan": "1aa55af304a2decaacca1d1fabe4257c277ca54a", "status": "affected", "version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "versionType": "git"}, {"lessThan": "d1f9f5839bd785a3a06335a01d53282e80f8e5fa", "status": "affected", "version": "2b0c3aee2172451e9f982b25f3fdf59a1b687dc3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c", "drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h", "drivers/gpu/drm/amd/amdgpu/psp_v11_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v12_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c", "drivers/gpu/drm/amd/amdgpu/psp_v14_0.c", "drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw\n\nChange psp_copy_fw from void to int: return -ENODEV when drm_dev_enter\nfails, and -EINVAL when the image size is zero or larger than the\n1 MiB PSP private buffer.\n\nReplace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw."}], "id": "CVE-2026-97494", "lastModified": "2026-10-30T13:21:05.267", "metrics": {}, "published": "2026-09-24T17:17:27.060", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1aa55af304a2decaacca1d1fabe4257c277ca54a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25bec2425c3d50ba9a92ad87bbf8628be29e5c32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ddda06ae356fda0418b7017e658d976dad6214e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb755c29d0fa8fa4b0630bf60cf434c30ffdf0c7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1f9f5839bd785a3a06335a01d53282e80f8e5fa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw", "id": "2540448", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540448"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw\nChange psp_copy_fw from void to int: return -ENODEV when drm_dev_enter\nfails, and -EINVAL when the image size is zero or larger than the\n1 MiB PSP private buffer.\nReplace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw.", "A flaw was found in the Linux kernel's AMD GPU driver. The driver fails to validate the size of firmware images before copying them into the Platform Security Processor (PSP) private buffer. A local user could exploit this vulnerability by loading an oversized or malformed firmware image, triggering a buffer overflow. This issue can cause a Denial of Service (DoS) via a system crash or potentially lead to memory corruption."], "name": "CVE-2026-97494", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97494\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97494\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97494.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,25bec2425c3d50ba9a92ad87bbf8628be29e5c32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1aa55af304a2decaacca1d1fabe4257c277ca54a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d1f9f5839bd785a3a06335a01d53282e80f8e5fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:00:10.324641+00:00", "updated": "2026-10-01T10:45:07.726891+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-120", "CWE-787"]}