Executive brief
A vulnerability in the Linux kernel's AMD GPU driver can cause a system crash when initializing certain high-end graphics cards (RDNA4/RX 9070 XT). The issue occurs because the driver attempts to allocate memory for hardware features that no longer exist on these newer chips, triggering an internal error. This results in a complete system failure (kernel crash) during the driver loading process, impacting system availability.
Technical details
A vulnerability exists in the amdgpu driver within the Linux kernel's DRM subsystem. On RDNA4 (GFX 12) hardware, certain on-chip memory resources (GDS, GWS, and OA) have been removed, leading the initialization code to set their sizes to zero. However, amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for these resources, which eventually invokes drm_mm_init() with a size of zero. This triggers a DRM_MM_BUG_ON assertion (when CONFIG_DRM_DEBUG_MM is enabled), resulting in a kernel panic during the modprobe phase. The fix implements an early return in amdgpu_ttm_init_on_chip() if the requested size is zero.
Affected products
- Linux Linux Kernel RDNA4 (GFX 12) hardware support
Timeline
- 2026-04-20: patched: Initial patch authored by Arjan van de Ven
- 2026-06-08: advisory: CVE-2026-46276 published by NVD
References
- https://git.kernel.org/stable/c/095a8b0ad3c3b5cdc3850d961adb8a8f735220bb
- https://git.kernel.org/stable/c/0e21db1a77967bc15df662efdca8ea8a61d124ea
- https://git.kernel.org/stable/c/1f5d33e7b0a9a2a140f46e22fb52eede323c5946
- https://git.kernel.org/stable/c/30c000a49094ec568c9b51b7421f7a4a3f0b0298
- https://git.kernel.org/stable/c/36f9602fb22ede69fcc8b422be0cf8105bf655ad
- https://git.kernel.org/stable/c/3e26c76891ab99fa173e9c501119fbb5c9f4600f
- https://git.kernel.org/stable/c/9bc925759c05feae7dfa9570e77131d54729c8ea