CVE-2026-43369
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel drm/amd driver, when GPU initialization fails due to an unsupported hardware block, IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, amdgpu_device_set_pg_state and amdgpu_device_set_cg_state iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a NULL pointer dereference. The fix adds NULL checks in both functions.
Risk Assessment
A kernel crash (NULL pointer dereference) may occur during GPU teardown after failed initialization, leading to system unavailability. It requires local access to an AMD GPU device.
Recommendation
Update the Linux kernel to a version with the fix. Avoid configurations with unsupported AMD GPU IP blocks until updated.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99284Unknown
In the Linux kernel, a vulnerability was resolved in the skb_zerocopy() function of the skbuff networking subsystem. The function does not propagate the shared-frag marker to the destination skb, breaking the invariant relied on by later in-place writers. As a result, an unprivileged user can write into the page cache of a root-owned read-only file.
- CVE-2026-99283Unknown
A bug in the Linux kernel netfilter conntrack TCP timeout selection was found. When an RST packet does not exactly match the expected sequence number, the conntrack entry remains ESTABLISHED, but the short CLOSE timeout (10 seconds) is still applied. A second non-exact RST can lower the timeout before the challenge ACK rate limit expires, allowing the conntrack entry to expire while both TCP endpoints remain established.
- CVE-2026-99282Unknown
In the Linux kernel, net/sched: sch_teql contains a use-after-free vulnerability. teql_master_xmit() incorrectly treats NET_XMIT_DROP as an unconsumed packet and operates on freed memory. The issue affects configurations with VLAN interfaces and pfifo qdisc with limit 0.
- CVE-2026-99281Unknown
A flaw in the Linux kernel tun/tap mechanism allowed processes without CAP_NET_ADMIN to attach to persistent tun devices that had no owner or group set. Anyone able to open /dev/net/tun could attach to such devices and intercept or inject network traffic. The fix now requires CAP_NET_ADMIN to attach to an ownerless, groupless device.
- CVE-2026-99280Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping table references. Session registration failure and connection cleanup can drop the table reference while the per-session procfs entry is still accessible. If a reader holds the last remaining reference, its final put calls proc_remove() from its own callback and waits for that callback to finish. Remove the procfs entry before dropping the table reference in the registration failure path. Queue sessions removed during connection cleanup and drain their procfs readers after releasing both session locks, then return their table references. Keep the global hash node unhashed while a session is queued so a concurrent unregister cannot drop the reference again. Previous-session replacement also destroys the file table before the session is finally freed. Detach the idr under the lock used by procfs file counters, and report zero files after it has been detached. This prevents a reader from accessing the idr during or after its destruction.
- CVE-2026-99278Unknown
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection. The pending setup limit only counts InProgress sessions. A client can complete authentication repeatedly and retain an unbounded number of Valid sessions on one connection. Reserve a connection slot before allocating a session and retain a connection reference while authentication is in progress. The first SMB3 channel takes over that reservation; binding to another connection reserves one slot there. Reauthentication and authentication continuation reuse the existing reservation. Return slots on allocation or insertion failure, channel removal, and final session destruction. Accept max_sessions_per_connection in reserved startup-request space and default to 64 when older tools leave it zero. Keep the request size and existing field offsets unchanged. Expose the configured limit in procfs. The existing connection limits bound the aggregate number of sessions without a separate global session allocation limit.
- CVE-2026-99259Unknown
In the Linux kernel, the soc/tegra: pmc driver has an uninitialised early_pmc->rate variable for legacy 32-bit Tegra devices. The variable is never configured and remains 0, triggering a warning in tegra_pmc_enter_suspend_mode(). The issue appeared after the PMC driver was changed to create the PMC context dynamically, updating rate only in the new context.
- CVE-2026-99258Unknown
In the Linux kernel, hv_apicid_to_vp_index() uses per-CPU hypercall input and output pages. In an SEV-SNP CoCo VM without a paravisor the output page is not allocated, so the hypervisor stores the resulting VP index into memory not allocated by the guest. The fix uses the input page for both input and output.
- CVE-2026-99257Unknown
In the Linux kernel, the shared GPIO mechanism based on platform lookup tables requires an associated struct device. An fwnode-based lookup with no associated device currently causes a NULL-pointer dereference. The fix adds a check that lets the kernel gracefully handle this situation with an error.
- CVE-2026-99256Unknown
In the Linux kernel, the dm cache module used a rw_semaphore for background_work_lock, although write locks on rw_semaphores have strict owner semantics. The locking process was not always the same as the unlocking one, triggering a warning with CONFIG_DEBUG_RWSEMS during suspend/resume of a cache device. The fix replaces the rw_semaphore with a spinlock and a wait queue.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix NULL pointer dereference in device cleanup When GPU initialization fails due to an unsupported HW block IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and amdgpu_device_set_cg_state which iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a kernel NULL pointer dereference. Add NULL checks for adev->ip_blocks[i].version in both amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent dereferencing NULL pointers during GPU teardown when initialization has failed. (cherry picked from commit b7ac77468cda92eecae560b05f62f997a12fe2f2)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS