Also known asEUVD-2026-86040 (ENISA EUVD) · GHSA-797r-35j2-ppqg (GitHub Security Advisories)Source: ENISA EUVD
A fix is available — apply it.
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/pm: bound pp_dpm_set_pp_table() memcpy
The powerplay path allocates hardcode_pp_table once with kmemdup(..., soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to PAGE_SIZE) with no upper bound, causing heap overflow. Reject writes where size exceeds soft_pp_table_size.
What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)
BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.
The score's inputs: In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it
September 24, 2026
October 3, 2026
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Red Hat Security Advisory: kernel security, bug fix, and enhancement update
Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update
Microsoft security update for CVE-2026-97427
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound...
| Vendor / Ecosystem | Fix (by version range) / Patch | Released | Source |
|---|---|---|---|
| linux | Kernel @ 6.1.189 (fixes >=4.6.0) | — | osv |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.1.106-1 ... 6.1.99-1 (57 versions) |
| — |
| linux-6.12 | 6.12.100-1~deb12u1, 6.12.101-1~deb12u1, 6.12.107-1~deb12u1 |
| — |
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.12.100-1 ... 6.12.96-1 (35 versions) |
| — |
| Package | Vulnerable range | Fix by version range | Dependents |
|---|---|---|---|
| linux | 6.12.100-1 ... 7.2~rc7-1~exp1 (180 versions) |
| — |
Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed its CVE.org record (CNA or CISA ADP). An arrow marks a change the record states ("CVSS → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). "EchelonGraph re-scored" is our own recompute of this CVE's score, not an update from a source, and is not counted in the refreshes above. Most recent first.
A repeat, a row identical to one the same pipeline wrote less than 10 seconds earlier, is not a separate refresh and is not counted. 1 repeat row among the latest 80 is merged into the row it repeats.
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-97427
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.