{"id":"CVE-2026-97493","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_b…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_b…","severity":"high","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a99cd231cd924b7160fecb9fb3a94b801522323b","Linux < 6.18.53","Linux (all versions)"],"published":"2026-09-24","updated":"2026-09-28","sourceUpdated":"2026-09-28T06:16:35.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97493","references":[{"url":"https://git.kernel.org/stable/c/a99cd231cd924b7160fecb9fb3a94b801522323b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0786b38af822fcd153d565cc85be7dbd9fed4d25"},{"url":"https://git.kernel.org/stable/c/6db45123306c7167c6867ca3d24924bd7960d947"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97493.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97493"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540475"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97493"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97493"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97493.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:88477"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00174,"epssPercentile":0.06844,"ingestedAt":"2026-09-24T16:47:15.867Z","patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"vendor","cwe":["CWE-787"],"slug":"CVE-2026-97493","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[]\nor walk an absurd number of entries on corrupt size fields.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:88477** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88477)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97493.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228173,"id":"CVE-2026-97493","ts":1792758153141,"field":"cvss","old":null,"new":"7.1"},{"seq":228172,"id":"CVE-2026-97493","ts":1792758153141,"field":"severity","old":"none","new":"high"}]}