CVE-2026-43367: Linux Kernel Privilege Escalation Flaw

CVE-2026-43367 Overview

CVE-2026-43367 is a NULL pointer dereference vulnerability [CWE-476] in the Linux kernel's AMD Direct Rendering Manager (DRM) driver. The flaw exists in device cleanup paths within the drm/amd subsystem, where the kernel fails to validate a version pointer before dereferencing it on unsupported hardware. A local user with low privileges can trigger the dereference during device teardown, causing a kernel crash and system-wide denial of service.

Critical Impact
Local attackers with low privileges can crash the Linux kernel by triggering AMD GPU device cleanup paths on unsupported hardware, resulting in high availability impact.

Affected Products

Linux Kernel (mainline and stable branches prior to the fix)
Systems using the drm/amd (AMDGPU) driver
Distributions shipping vulnerable stable kernel releases

Discovery Timeline

2026-05-08 - CVE-2026-43367 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43367

Vulnerability Analysis

The vulnerability resides in the AMD GPU driver (drm/amd) cleanup logic within the Linux kernel. During device teardown, several code paths access a version pointer without confirming it is non-NULL. On unsupported AMD hardware, this pointer remains uninitialized, and dereferencing it triggers a kernel oops. The upstream fix, cherry-picked from commit f5a05f8414fc10f307eb965f303580c7778f8dd2, introduces explicit NULL checks before each affected dereference.

The attack vector is local and requires low privileges. There is no impact to confidentiality or integrity, but the availability impact is high because a successful trigger panics the kernel. The Exploit Prediction Scoring System (EPSS) places this CVE in a very low likelihood band, consistent with bugs that require local access and specific hardware conditions.

Root Cause

The root cause is missing input validation [CWE-476] on a version pointer field referenced during AMD GPU device cleanup. On supported hardware, the pointer is initialized during probe. On unsupported hardware, certain cleanup paths still execute and read the uninitialized pointer, producing a NULL dereference.

Attack Vector

Exploitation requires local access to a system running a vulnerable kernel with the AMD GPU driver loaded against unsupported hardware. A low-privileged user who can trigger device cleanup operations, such as module unload sequences or driver re-initialization, can reach the vulnerable code path. The result is a kernel crash. There is no known path to code execution or privilege escalation given the nature of the dereference and the absence of attacker-controlled memory at the faulting address.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-43367

Indicators of Compromise

Kernel oops or panic messages referencing amdgpu or drm/amd functions in dmesg and /var/log/kern.log.
Stack traces indicating a NULL pointer dereference during device removal or driver unload events.
Unexpected system reboots or hangs correlated with GPU driver module operations.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against the patched stable releases referenced in the kernel.org commits.
Monitor kernel ring buffer output for BUG: unable to handle kernel NULL pointer dereference entries tied to AMD GPU symbols.
Alert on repeated amdgpu module load and unload sequences from non-administrative users.

Monitoring Recommendations

Centralize kernel logs into a SIEM and create detections for NULL pointer dereference signatures from DRM subsystems.
Track host availability metrics to identify nodes experiencing GPU-related crashes that may indicate exploitation or stability issues.
Audit which workstations and servers run the AMD GPU driver against hardware not on the supported list.

How to Mitigate CVE-2026-43367

Immediate Actions Required

Apply the upstream Linux kernel patches from your distribution as soon as backported builds are available.
Identify hosts loading the amdgpu module on unsupported AMD hardware and prioritize them for remediation.
Restrict local shell access on multi-user systems to reduce exposure to local denial-of-service conditions.

Patch Information

The fix is available in the upstream Linux kernel through the following commits: Kernel Git Commit 38f1640, Kernel Git Commit 5edcb0d, and Kernel Git Commit 72ecb1d. The change adds NULL checks to the cleanup paths that dereference the version pointer. Update to the stable kernel release that includes these commits via your distribution's package manager.

Workarounds

Blacklist the amdgpu kernel module on systems where the hardware is unsupported and the driver is not required.
Use an alternative driver such as radeon where supported by the hardware until patched kernels are deployed.
Limit local user access and avoid running untrusted code on unpatched systems hosting the vulnerable driver.

bash

# Blacklist the amdgpu module on unsupported hardware
echo "blacklist amdgpu" | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u
sudo reboot