PT-2026-8158 · Linux+2 · Linux Kernel+4
Published
2026-01-01
·
Updated
2026-05-22
·
CVE-2026-23163
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains a flaw in the drm/amdgpu subsystem, specifically within the
amdgpu gmc filter faults remove function. On APUs like Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and ih2 interrupt ring buffers are not initialized. The issue arises because the function unconditionally uses ih1 to retrieve a timestamp, leading to a NULL pointer dereference when retry faults are enabled and the function is called during SVM page fault recovery. This can result in a kernel crash. The problem was exposed by a recent commit that changed the default retry fault handling for Renoir APUs. The fix involves adding a check for ih1.ring size before accessing it and restoring soft ih support. The vulnerable function is amdgpu gmc filter faults remove(), which calls amdgpu ih decode iv ts helper().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Raven
Renoir
Ubuntu
Amdgpu