Executive brief
A vulnerability in the Linux kernel's AMD graphics driver could allow a local user to crash the system. The issue occurs when the system attempts to read information about faulty memory pages on certain AMD hardware. This can lead to a 'blue screen' style system failure (kernel panic), impacting the availability of the machine.
Technical details
A NULL pointer dereference exists in the amdgpu_ras_sysfs_badpages_read function within the Linux kernel's AMDGPU driver. The vulnerability is triggered when the EEPROM contains only invalid address entries, causing the driver to skip necessary memory allocation for RAS data. When the system subsequently attempts to access this unallocated memory during a sysfs read operation, it triggers a supervisor read access fault in kernel mode. An attacker with local access could exploit this to cause a denial of service (kernel oops/panic). The fix involves moving the RAS data allocation call before the bad page check to ensure memory is always initialized.
Affected products
- Linux Linux Kernel 6.18 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-11-21: other: Patch authored by Asad Kamal
- 2025-12-08: other: Patch committed to main tree
- 2026-03-04: patched: Patch committed to stable branches 6.18.y and 6.19.y
- 2026-05-06: disclosed: CVE published