Executive brief
The AMD GPU (amdgpu) driver in the Linux kernel can crash with a NULL pointer dereference during system startup if the MES (Micro Engine Scheduler) initialization fails. This causes the driver to fail to load, preventing graphics hardware from becoming available and making the system unusable on affected AMD GPUs.
Technical details
This is a NULL pointer dereference (CWE-476) in the amdgpu DRM driver that occurs when MES hardware initialization fails during driver probe. The vulnerability arises because the KIQ (Kernel Interface Queue) ring is incorrectly marked as ready even when MES init fails; on ASICs using MES, the KIQ ring is owned and managed by MES and should not be flagged as ready on init failure. The crash manifests as a NULL dereference in gfx_v12_1_wait_reg_mem() when attempting to access GPU memory management structures during device finalization. The fix adds a check to clear the KIQ ring's ready flag if MES initialization fails, preventing downstream code from attempting to use an invalid ring. Attack vector is local (driver load on system with affected AMD GPU); no authentication or network access required.
Affected products
- Linux Linux kernel 5.10 and later (GFX v12.0 and v12.1 support)
Timeline
- 2026-08-10: disclosed
- 2026-06-26: patched: Upstream fix committed by Harish Kasiviswanathan