CVE-2026-43131: Linux Kernel AMD PM Null Pointer Vulnerability

CVE-2026-43131 Overview

CVE-2026-43131 is a null pointer dereference vulnerability in the Linux kernel's AMD GPU power management subsystem (drm/amd/pm). The flaw occurs during Reliability, Availability, and Serviceability (RAS) initialization when the System Management Unit (SMU) is disabled. Under this condition, code paths reference SMU structures that have not been allocated, triggering a kernel null pointer dereference.

Critical Impact
A null pointer dereference during RAS initialization on systems with SMU disabled can cause a kernel oops or system crash, resulting in denial of service on affected AMD GPU configurations.

Affected Products

Linux kernel versions containing the vulnerable drm/amd/pm code path
Systems using AMD GPUs where the SMU is disabled
Distributions tracking the upstream stable Linux kernel tree

Discovery Timeline

2026-05-06 - CVE-2026-43131 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43131

Vulnerability Analysis

The vulnerability resides in the AMD Direct Rendering Manager power management code (drm/amd/pm) within the Linux kernel. During RAS subsystem initialization, the code accesses SMU-related structures without first verifying that SMU support is enabled. When SMU is disabled, the corresponding pointer remains NULL, and the dereference triggers a kernel fault.

This class of issue maps to a Null Pointer Dereference (CWE-476) and typically manifests as a denial of service. The EPSS probability for this CVE is 0.018%, indicating a very low likelihood of opportunistic exploitation in the wild.

Root Cause

The root cause is missing input validation on the SMU state before RAS initialization proceeds. The initialization routine assumes the SMU pointer is valid and invokes operations against it. When kernels are built or booted in configurations where the SMU is not active, the unchecked dereference produces a kernel panic. The patch adds the necessary guard before the dereference occurs.

Attack Vector

Triggering the bug requires a system configuration where the AMD SMU is disabled while the AMD GPU driver still attempts RAS initialization. The condition is reached through normal driver load on affected hardware and configurations rather than through remote network input. The practical impact is a local denial of service on boot or driver initialization. No code execution primitive has been documented for this issue.

The upstream fix is recorded in two stable tree commits: 1197366cca89a4c44c541ddedb8ce8bf0757993d and 8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c. Refer to the Kernel.org commit and the companion commit for the precise source-level changes.

Detection Methods for CVE-2026-43131

Indicators of Compromise

Kernel oops or panic messages referencing amdgpu, smu, or RAS initialization functions during boot or module load
BUG: kernel NULL pointer dereference entries in dmesg or journalctl -k correlating with AMD GPU driver bring-up
Repeated GPU driver initialization failures on systems where the SMU has been disabled

Detection Strategies

Compare running kernel version against the fixed commits in the stable tree to confirm whether the patch is applied
Audit hosts with AMD GPUs for boot-time crash signatures tied to drm/amd/pm code paths
Use configuration management tooling to inventory kernel build versions across the Linux fleet

Monitoring Recommendations

Centralize kernel logs and alert on NULL pointer dereference strings originating from AMD GPU modules
Track unexpected reboots or GPU driver load failures on workstations and servers using AMD graphics
Validate kernel package versions after each update cycle to ensure stable backports are present

How to Mitigate CVE-2026-43131

Immediate Actions Required

Apply the upstream Linux kernel patch from the stable tree to all affected systems
Update to a distribution kernel build that includes commits 1197366cca89 and 8e035505fa0e
Reboot systems after kernel updates to load the corrected amdgpu module

Patch Information

The fix was merged into the Linux stable tree under commits 1197366cca89a4c44c541ddedb8ce8bf0757993d and 8e035505fa0e5b7c4306fd3f4e27f8e8f5bfad8c. The patch adds a guard check so that RAS initialization no longer dereferences the SMU pointer when SMU is disabled. Consume the fix through your Linux distribution's security update channel.

Workarounds

On affected systems, avoid configurations that disable the SMU until the patched kernel is deployed
Where feasible, disable the AMD GPU driver (amdgpu) on hosts that do not require GPU functionality
Restrict console and physical access to reduce the chance of triggering crash conditions on shared systems

bash

# Verify the running kernel includes the fix commits
uname -r
rpm -q --changelog kernel | grep -E '1197366cca89|8e035505fa0e'
# Debian/Ubuntu equivalent
dpkg -l | grep linux-image
apt changelog linux-image-$(uname -r) | grep -E '1197366cca89|8e035505fa0e'