CVE-2026-43369: Linux Kernel NULL Pointer Vulnerability

CVE-2026-43369 Overview

CVE-2026-43369 is a NULL pointer dereference vulnerability in the Linux kernel's AMD Direct Rendering Manager (DRM) driver. The flaw resides in the amdgpu_device_fini_hw cleanup path, where the kernel iterates over IP blocks without validating their version pointers. When GPU initialization fails due to an unsupported hardware block, the cleanup routines amdgpu_device_set_pg_state and amdgpu_device_set_cg_state dereference NULL pointers, triggering a kernel crash. The vulnerability affects Linux systems using AMD graphics hardware and is categorized as [CWE-476] Null Pointer Dereference.

Critical Impact
A local user can trigger a kernel NULL pointer dereference during failed AMD GPU initialization, causing system-wide denial of service through kernel panic.

Affected Products

Linux Kernel (upstream stable branches prior to fix commits)
Distributions shipping the amdgpu DRM driver
Systems with AMD GPU hardware where initialization can fail on unsupported IP blocks

Discovery Timeline

2026-05-08 - CVE-2026-43369 published to NVD
2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-43369

Vulnerability Analysis

The vulnerability exists in the AMD GPU driver (drm/amd) within the Linux kernel. The amdgpu driver organizes hardware functionality into IP blocks, each represented by an entry in the adev->ip_blocks[] array. Each block carries a version pointer that exposes power gating and clock gating callbacks.

When GPU initialization fails because the driver encounters an unsupported hardware block, some entries in ip_blocks[] retain a NULL version pointer. The teardown path in amdgpu_device_fini_hw invokes amdgpu_device_set_pg_state and amdgpu_device_set_cg_state, which iterate over every IP block and access adev->ip_blocks[i].version without checking for NULL. This dereference triggers a kernel oops and halts execution.

Root Cause

The root cause is missing NULL validation in cleanup functions that assume all IP block entries are fully initialized. The patched code adds explicit NULL checks for adev->ip_blocks[i].version in both amdgpu_device_set_cg_state and amdgpu_device_set_pg_state before accessing version callback fields.

Attack Vector

Exploitation requires local access with low privileges. An attacker capable of triggering AMD GPU driver initialization, for example by loading the amdgpu module under conditions where an IP block is unsupported, can force the failure path that leads to the NULL dereference during teardown. The result is a kernel crash and denial of service. The flaw does not expose confidentiality or integrity impact, only availability.

No verified public exploitation code is available. The vulnerability manifests through normal driver teardown logic when initialization partially fails. See the upstream commits at Kernel Git Commit 062ea90, Kernel Git Commit 43025c9, and Kernel Git Commit 767cd24 for the technical fix details.

Detection Methods for CVE-2026-43369

Indicators of Compromise

Kernel oops or panic messages referencing amdgpu_device_set_pg_state or amdgpu_device_set_cg_state in dmesg or system logs.
Repeated unsuccessful loads of the amdgpu kernel module followed by system instability.
Crash signatures showing NULL pointer dereference at addresses associated with adev->ip_blocks[i].version access.

Detection Strategies

Monitor kernel ring buffer output for stack traces involving amdgpu_device_fini_hw after GPU initialization failures.
Audit installed kernel versions against the patched stable releases referenced in the upstream commits.
Correlate GPU initialization failure events with subsequent kernel crashes to identify systems exposed to the flaw.

Monitoring Recommendations

Ingest /var/log/kern.log and journald output into a centralized log platform to detect AMD DRM crash signatures at scale.
Track amdgpu module load and unload activity on hosts with AMD GPUs to identify abnormal patterns.
Alert on unexpected kernel panics on workstations and servers using AMD graphics hardware.

How to Mitigate CVE-2026-43369

Immediate Actions Required

Update affected Linux kernels to versions containing the upstream fix commits 062ea90, 43025c9, or 767cd24.
Restrict access to systems with AMD GPUs so that only trusted local users can load or interact with the amdgpu driver.
Reboot systems after applying the patched kernel to ensure the corrected amdgpu module is loaded.

Patch Information

The fix was committed upstream in three stable branch backports. Apply the kernel update referenced in Kernel Git Commit 062ea90, Kernel Git Commit 43025c9, or Kernel Git Commit 767cd24. The patch adds NULL checks for adev->ip_blocks[i].version in amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent dereferencing uninitialized IP block entries.

Workarounds

Blacklist the amdgpu module on systems that do not require AMD GPU acceleration until the patched kernel is deployed.
Avoid configurations that expose unsupported AMD IP blocks to the driver, reducing the likelihood of initialization failure.
Limit local shell and module-loading capabilities through standard Linux access controls and CAP_SYS_MODULE restrictions.

bash

# Blacklist amdgpu module until patched kernel is installed
echo "blacklist amdgpu" | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u

# Verify running kernel version after patching
uname -r