CVE-2026-64097: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64097 Overview

CVE-2026-64097 is an out-of-bounds read vulnerability in the Linux kernel's AMD display driver (drm/amd/display). The flaw exists in the GPIO pin lookup table parsers get_gpio_i2c_info() and bios_parser_get_gpio_pin_info(). Both functions derive an element count from the VBIOS table_header.structuresize field and iterate over gpio_pin[] entries without validating that the full claimed size fits within the mapped BIOS image. A local authenticated attacker with the ability to influence VBIOS parsing or trigger the affected code path can cause the kernel to read past the end of the BIOS image.

Critical Impact
A local attacker can trigger an out-of-bounds read in kernel memory, potentially leading to information disclosure, kernel memory corruption, or denial of service on systems using AMD display hardware.

Affected Products

Linux kernel with drm/amd/display (AMD Display Core Next) driver enabled
Systems using AMD GPUs with VBIOS-based GPIO pin lookup tables
Multiple upstream stable branches referenced by the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64097 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64097

Vulnerability Analysis

The vulnerability resides in the AMD Display Core Next (DCN) BIOS parser code path that reads GPIO pin lookup tables from the video BIOS (VBIOS). Two functions, get_gpio_i2c_info() and bios_parser_get_gpio_pin_info(), use the structuresize value declared in the VBIOS table_header to compute how many gpio_pin[] entries to walk. The GET_IMAGE() macro only validates that the table header itself is mapped within bounds. It does not verify that the entire structure declared by structuresize is accessible. When the VBIOS reports a structuresize larger than the actual mapped BIOS region, the iteration loop reads memory beyond the end of the image.

The fix replaces the header-only bounds check with a call to bios_get_image(), which validates that the full claimed structuresize fits within the BIOS image before entering the loop. This is classified as an out-of-bounds read [CWE-125].

Root Cause

The root cause is missing validation of an attacker-influenceable size field before performing pointer arithmetic and iteration. The parser trusts table_header.structuresize without verifying that the declared region is fully contained within the mapped VBIOS image. Attacker-controlled or malformed VBIOS content can cause the driver to compute an end pointer past the image boundary.

Attack Vector

Exploitation requires local access with low privileges. An attacker who can supply or influence a crafted VBIOS image, or who can trigger the affected parsing path on a system with a malformed BIOS table, causes the kernel driver to iterate beyond valid memory. The consequences include kernel information disclosure, driver instability, or denial of service on the display subsystem. Because the read occurs in kernel context, adjacent kernel data may be exposed to the parser and reachable through subsequent driver behavior.

No verified public exploit code has been released. See the upstream fix in the Linux Kernel Commit ba5e95b for the exact patched logic.

Detection Methods for CVE-2026-64097

Indicators of Compromise

Kernel log entries referencing amdgpu, dc_bios, or bios_parser warnings during driver initialization or mode-setting operations
Unexpected KASAN (Kernel Address Sanitizer) out-of-bounds read reports in get_gpio_i2c_info or bios_parser_get_gpio_pin_info call stacks
Display subsystem crashes or GPU reset events shortly after driver load on AMD hardware

Detection Strategies

Inventory Linux hosts running AMD GPU drivers and cross-reference installed kernel versions against the six upstream fix commits listed in NVD
Enable KASAN on test systems to surface out-of-bounds reads in the AMD display BIOS parser during boot and driver reload
Monitor dmesg and journald for amdgpu errors, VBIOS parsing failures, and unexpected driver probe warnings

Monitoring Recommendations

Aggregate kernel logs centrally and alert on amdgpu warnings or oops events referencing BIOS parser functions
Track kernel package versions across the fleet and flag hosts running pre-patch kernels that include the AMD display driver
Correlate GPU reset counters and X server or Wayland compositor restarts with kernel driver messages to identify unstable hosts

How to Mitigate CVE-2026-64097

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry across all Linux hosts running AMD GPU drivers
Prioritize multi-user Linux systems, shared workstations, and virtualization hosts where local users are present
Restrict local access to trusted users on systems that cannot be patched immediately

Patch Information

The upstream fix adds a bios_get_image() call that validates the full VBIOS structuresize before iterating over the GPIO pin table in both get_gpio_i2c_info() and bios_parser_get_gpio_pin_info(). The fix has been backported across multiple stable branches. Reference commits: Linux Kernel Commit 67461e0, Linux Kernel Commit 7ca695b, Linux Kernel Commit 86d2b20, Linux Kernel Commit 9900f69, Linux Kernel Commit f2a4827, and Linux Kernel Commit fb30a38.

Workarounds

On systems where the AMD display driver is not required, blacklist the amdgpu module to prevent the vulnerable code path from executing
Limit local login and remote shell access to trusted administrators until patches are deployed
Enable kernel hardening options such as KASLR and lockdown mode to reduce the impact of kernel information disclosure

bash

# Check running kernel version and AMD display driver status
uname -r
lsmod | grep amdgpu

# Optional: blacklist amdgpu if the driver is not required
echo "blacklist amdgpu" | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u

# Apply distribution kernel updates
# Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r)

# RHEL/Fedora
sudo dnf update kernel