Executive brief
A flaw in the Linux kernel's AMD GPU driver could cause the system to crash (kernel oops) when validating memory allocation requests. The bug occurs when the driver attempts to validate the size of GPU memory allocations without first checking whether the memory manager has been properly initialized, leading to a crash when the system tries to access uninitialized memory structures.
Technical details
The vulnerability is a null pointer dereference in the amdgpu_bo_validate_size() function within the AMD GPU DRM driver. The root cause is that the function attempts to dereference a TTM (Translation Table Maps) domain manager pointer without first validating that the manager exists. An attacker or user-space application can trigger this by requesting memory allocation in GTT (Graphics Translation Table) or VRAM domains, causing the kernel to attempt to access the uninitialized manager pointer and crash. The vulnerability requires local access to the system and the ability to invoke GPU memory allocation calls. A patch has been available since December 2022 that adds NULL pointer checks before dereferencing the manager pointer.
Affected products
- Linux Linux kernel prior to commit 7554886daa31eacc8e7fac9e15bbce67d10b8f1f
Timeline
- 2022-12-10: other: Patch committed by Luben Tuikov
- 2022-12-14: patched: Patch merged by Alex Deucher
- 2025-10-07: advisory: CVE-2022-50527 published