CVE-2026-97494 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for maintaining and securing systems that use the drm/amdgpu module should review and apply the kernel patch to ensure the vulnerability is resolved.

Why it matters

A vulnerability in the Linux kernel's drm/amdgpu module has been resolved. Although no exploitation has been reported, applying the kernel patch is recommended to prevent potential issues.

• Verify kernel patch application to prevent potential issues.
• Monitor system logs for anomalies related to the drm/amdgpu module.

Technical summary

The psp_copy_fw function in the Linux kernel's drm/amdgpu module has been modified to return an integer value, allowing for error handling when drm_dev_enter fails or when the image size exceeds the 1 MiB PSP private buffer. This change replaces open-coded memset/memcpy into fw_pri_buf with psp_copy_fw, enhancing error handling and buffer management in the drm/amdgpu module. The update addresses a vulnerability that could potentially lead to system instability or security issues if exploited. Linux kernel developers and administrators should review the kernel patch and apply it to ensure the vulnerability is resolved.

Defensive priority

Low priority, as the vulnerability has been resolved and no exploitation has been reported.

Recommended defensive actions

• Review and apply the kernel patch to ensure the vulnerability is resolved.
• Monitor system logs for potential issues related to the drm/amdgpu module.
• Verify the kernel version to ensure it includes the fix.
• Perform a thorough review of the system's configuration and deployment to identify potential exposure.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. No additional evidence of exploitation or impact is available. Linux kernel developers should verify the kernel patch application to prevent potential issues. The PSP private buffer size is limited to 1 MiB, and the psp_copy_fw function now returns an integer value for error handling.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.