CVE-2026-43398: Linux Kernel AMDGPU DOS Vulnerability

CVE-2026-43398 Overview

CVE-2026-43398 is a Linux kernel vulnerability in the AMD GPU (amdgpu) driver. The flaw resides in the amdgpu_userq_wait_ioctl function, which fails to validate the upper bound of user-supplied input values. A local attacker can supply large input values through this ioctl interface, triggering an out-of-memory (OOM) condition. The upstream fix adds a bounds check against AMDGPU_USERQ_MAX_HANDLES to constrain inputs to a range appropriate for legitimate use cases. The fix was cherry-picked from commit fcec012c664247531aed3e662f4280ff804d1476 and applied across multiple stable kernel branches.

Critical Impact
Local users invoking the amdgpu user-queue wait ioctl with oversized handle counts can exhaust kernel memory, leading to denial of service on systems with AMD GPUs.

Affected Products

Linux kernel branches containing the amdgpu user-queue wait ioctl implementation
Systems using AMD GPU hardware with the amdgpu Direct Rendering Manager (DRM) driver
Distributions shipping stable kernels prior to the patches referenced in the upstream commits

Discovery Timeline

2026-05-08 - CVE-2026-43398 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43398

Vulnerability Analysis

The vulnerability exists in the AMD GPU DRM driver's user-queue subsystem. The amdgpu_userq_wait_ioctl function accepts user-provided input values that influence kernel memory allocation. The original implementation did not enforce an upper bound on these inputs.

When a local user invokes this ioctl with very large values, the kernel attempts to allocate corresponding resources. The allocation can grow large enough to trigger an OOM condition, destabilizing the system and potentially terminating processes selected by the kernel OOM killer.

The upstream remediation introduces a constant, AMDGPU_USERQ_MAX_HANDLES, sized large enough to cover legitimate workloads while preventing attacker-controlled resource exhaustion. Inputs exceeding this threshold are rejected before allocation occurs.

Root Cause

The root cause is missing input validation on user-controlled values consumed by an ioctl handler in kernel space. Without an upper-bound check, an unprivileged caller can drive a kernel allocation path with arbitrary magnitudes. This pattern matches a resource exhaustion weakness in a privileged code path reachable from userspace.

Attack Vector

The attack vector is local. An attacker requires the ability to open the amdgpu DRM device node and issue ioctls against it. On many desktop distributions, members of the video or render group hold this access by default. The attacker crafts an amdgpu_userq_wait_ioctl call supplying oversized values for the inputs that bound the wait operation, prompting the kernel to attempt an excessive allocation.

No verified public proof-of-concept code is associated with this CVE. The vulnerability is described in prose only based on the upstream commit messages. See the kernel.org commit references for the canonical fix.

Detection Methods for CVE-2026-43398

Indicators of Compromise

Kernel log entries showing OOM killer activity on systems with AMD GPUs and no corresponding legitimate memory pressure
Unexpected process terminations correlated with userspace activity against /dev/dri/card* or /dev/dri/renderD*
Repeated ioctl invocations against the amdgpu device node from non-graphics processes

Detection Strategies

Audit ioctl syscalls targeting amdgpu DRM device nodes using auditd rules or eBPF tracing
Correlate spikes in kernel slab and page allocator usage with userspace processes holding handles to /dev/dri/*
Track installed kernel versions across the fleet and flag hosts running kernels predating the patch commits

Monitoring Recommendations

Forward dmesg and kern.log data to a centralized log platform and alert on OOM killer invocations
Monitor for unprivileged processes opening DRM render nodes outside expected graphical workloads
Track kernel package versions via configuration management to confirm patch rollout

How to Mitigate CVE-2026-43398

Immediate Actions Required

Apply the upstream stable kernel updates referenced in the kernel.org git commits for your kernel branch
Inventory hosts using AMD GPUs and the amdgpu driver, prioritizing multi-user systems and shared workstations
Restrict membership of the video and render groups to trusted users where feasible

Patch Information

The fix adds an upper-bound check against AMDGPU_USERQ_MAX_HANDLES in amdgpu_userq_wait_ioctl. The patch was cherry-picked from commit fcec012c664247531aed3e662f4280ff804d1476 and merged across stable branches in commits 3cd93bc6, 64ac7c09, and b1d10508. Distribution-provided kernel updates incorporating these commits should be deployed.

Workarounds

Tighten Discretionary Access Control (DAC) on /dev/dri/render* and /dev/dri/card* to limit which local users can issue ioctls
Where AMD GPU acceleration is not required, blacklist the amdgpu module to remove the attack surface
Apply seccomp or Linux Security Module (LSM) policies to deny ioctl on DRM devices for services that do not need GPU access

bash

# Example: restrict DRM render node access to a dedicated group
sudo groupadd -r gpu-users
sudo chgrp gpu-users /dev/dri/renderD128
sudo chmod 0660 /dev/dri/renderD128

# Verify the running kernel includes the fix
uname -r
rpm -q --changelog kernel | grep -i amdgpu_userq_wait_ioctl