Executive brief
A vulnerability in the Linux kernel's AMD64 graphics hardware driver can cause a system crash (General Protection Fault). This occurs primarily in virtualized environments where the expected AMD hardware is missing but the driver fails to shut down properly. An exploit would result in a complete system outage, impacting availability and ongoing operations.
Technical details
A NULL pointer dereference exists in the AMD64 AGP driver (drivers/char/agp/amd64-agp.c) within the Linux kernel. The root cause is broken error propagation in agp_amd64_probe(); the function checks if cache_nbs() returns exactly -1 instead of any negative value. When running in virtualized environments (like QEMU/KVM) without a physical AMD northbridge, cache_nbs() returns -ENODEV, which is masked by the incorrect check. This allows initialization to proceed until amd64_fetch_size() attempts to dereference a NULL pointer returned by node_to_amd_nb(0), resulting in a General Protection Fault. The issue has been patched by correcting the error check to abort on any negative return value.
Affected products
- Linux Linux 2.6.18 to 7.1.2
Timeline
- 2026-06-08: patched: Initial patch committed to kernel tree
- 2026-06-29: disclosed: CVE published