{"id":"CVE-2026-98914","kind":"vulnerability","aliases":["CVE-2026-98914"],"related":[],"title":"Linux amdgpu driver: unbounded ATOM command table nesting could loop kernel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: cap ATOM command table nesting depth\n\nCap nesting at 32 levels with execute_depth and\nreturn -ELOOP when exceeded.","summary":"The amdgpu graphics driver in the Linux kernel parses ATOM BIOS command tables and did not limit how deeply they could nest. The fix caps nesting at 32 levels and returns -ELOOP when exceeded.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-gpu","amdgpu","infrastructure","kernel","linux","workstations"],"not_affected_if":["no-amd-gpu","non-linux"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream amdgpu ATOM nesting-depth fix (version unknown from sources)","status":"open","published_at":"2026-10-23T12:18:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:27+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T04:58:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream amdgpu ATOM nesting-depth fix (version unknown from sources)","reach":"local","title":"Linux amdgpu driver: unbounded ATOM command table nesting could loop kernel","impact":"medium","summary":"The amdgpu graphics driver in the Linux kernel parses ATOM BIOS command tables and did not limit how deeply they could nest. The fix caps nesting at 32 levels and returns -ELOOP when exceeded.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","amd-gpu","amdgpu","workstations"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; kernel-level impact not stated in sources","analyst_note":"Check the NVD entry and the upstream kernel commit for the trigger, the attacker privilege required, and the fixed kernel versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-amd-gpu","non-linux"],"who_is_affected":"Systems running the Linux kernel with an AMD GPU using the amdgpu driver, where the ATOM BIOS interpreter is active. Systems without AMD graphics hardware are not reached by this code path. The sources do not describe the exact trigger or attacker position.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000583,"input_tokens":3296,"output_tokens":507,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98914':14A,17A '32':53B,80C 'amd':19B 'amd-gpu':18B 'amdgpu':2A,21B,27B 'atom':5A,35B,72C 'bio':36B 'cap':50B,71C,77C 'command':6A,37B,73C 'could':9A,46B 'cve':12A,15A 'deepli':44B 'depth':76C,84C 'driver':3A,29B 'drm/amdgpu':70C 'eloop':57B,87C 'exceed':59B,89C 'execut':83C 'fix':49B 'follow':65C 'gpu':20B 'graphic':28B 'infrastructur':22B 'kernel':11A,23B,33B,63C 'level':54B,81C 'limit':42B 'linux':1A,24B,32B,62C 'loop':10A 'nest':8A,47B,51B,75C,78C 'pars':34B 'resolv':69C 'return':56B,86C 'tabl':7A,38B,74C 'unbound':4A 'vulner':66C 'workstat':25B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with an AMD GPU using the amdgpu driver, where the ATOM BIOS interpreter is active. Systems without AMD graphics hardware are not reached by this code path. The sources do not describe the exact trigger or attacker position.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98914","severity":null,"published_at":"2026-10-23T12:18:25+00:00","modified_at":"2026-10-23T12:18:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98914","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98914","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}