Executive brief
The AMD GPU driver in the Linux kernel has an initialization ordering bug in its VRAM memory manager. If the cgroup registration function fails during GPU driver load, the cleanup code attempts to access uninitialized data structures (null pointers), causing the kernel to crash. This affects GPU initialization and can prevent the graphics driver from loading successfully.
Technical details
The vulnerability is a null pointer dereference caused by incorrect initialization order in amdgpu_vram_mgr_init(). The drmm_cgroup_register_region() call was placed before INIT_LIST_HEAD() and gpu_buddy_init() in the initialization sequence. If drmm_cgroup_register_region() fails, the function returns early, leaving list_head structures and the buddy allocator uninitialized. When the error handling path invokes amdgpu_vram_mgr_fini(), it unconditionally calls list_for_each_entry_safe() and gpu_buddy_fini() on these uninitialized structures, dereferencing null pointers in both cases. The fix reorders the initialization so drmm_cgroup_register_region() is called last, after all data structures are fully initialized, allowing safe cleanup on failure. This affects kernel v6.14 and later.
Affected products
- Linux Linux kernel v6.14+
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Fix committed to stable Linux kernel