Executive brief
A vulnerability was identified in the Linux kernel's AMD graphics driver where certain hardware configurations could cause the system to crash during device cleanup. This occurs when the driver attempts to access memory locations that haven't been properly initialized, leading to a 'NULL pointer dereference.' In practice, this could result in a system crash or denial of service when the computer is shutting down or removing graphics hardware.
Technical details
A NULL pointer dereference vulnerability exists in the amdgpu driver within the Linux kernel. The issue occurs in the 'amdgpu_device_ip_fini_early' and 'amdgpu_device_ip_fini' functions in 'drivers/gpu/drm/amd/amdgpu/amdgpu_device.c'. When the driver performs cleanup on unsupported hardware, it may encounter a NULL version pointer for certain IP blocks. Without proper validation, the driver attempts to dereference this pointer to access function tables or block types, leading to a kernel oops. The fix introduces explicit NULL checks for the version pointer before access. This is primarily a local denial-of-service vector during driver teardown.
Affected products
- Linux Linux Kernel v6.13 and earlier
Timeline
- 2026-03-05: other: Initial patch authored
- 2026-03-19: patched: Patch committed to stable branches
- 2026-05-08: disclosed: CVE published