CVE-2026-45976 Overview
CVE-2026-45976 is a memory leak vulnerability in the Linux kernel's AMD GPU (amdgpu) Direct Rendering Manager (DRM) driver. The flaw resides in the amdgpu_ras_init() function, which handles RAS (Reliability, Availability, Serviceability) initialization for AMD graphics hardware. When the amdgpu_nbio_ras_sw_init() call fails, the function returns immediately without releasing the previously allocated con structure. Each failed initialization attempt leaks kernel memory, gradually exhausting kernel resources on affected systems. The issue was identified through a prototype static analysis tool and code review, and has been compile-tested only.
Critical Impact
Repeated failures in amdgpu_ras_init() can leak kernel memory, contributing to resource exhaustion on systems running affected AMD GPU drivers.
Affected Products
- Linux kernel versions containing the amdgpu DRM driver with the vulnerable amdgpu_ras_init() code path
- Systems using AMD GPUs that exercise the RAS initialization routine
- Linux distributions shipping the affected stable kernel branches prior to the referenced patches
Discovery Timeline
- 2026-05-27 - CVE-2026-45976 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45976
Vulnerability Analysis
The vulnerability is a kernel memory leak [CWE-401] in the AMD GPU DRM driver. The amdgpu_ras_init() function allocates a con structure during RAS subsystem initialization. The driver then calls several sub-initializers, including amdgpu_nbio_ras_sw_init() for the Northbridge I/O RAS software setup.
When amdgpu_nbio_ras_sw_init() returns an error, the original code path executes a direct return statement. The allocated con structure is never freed and no reference remains to release it later. Each error path traversal leaks the memory associated with that allocation.
The fix redirects the error path to the existing release_con label, ensuring the allocated structure is properly freed before the function returns the error code. This aligns the error handling with the other failure paths in the same function.
Root Cause
The root cause is incomplete error handling. The developer added the amdgpu_nbio_ras_sw_init() call without routing its failure case through the existing cleanup label. Direct return statements after allocations are a recurring source of leaks in kernel drivers and a known anti-pattern in goto-based cleanup code.
Attack Vector
Triggering the leak requires conditions that cause amdgpu_nbio_ras_sw_init() to fail during driver initialization. A local attacker with the ability to repeatedly load and unload the amdgpu module, or to induce initialization failures, could amplify the leak. The vulnerability does not provide code execution or information disclosure, and exploitation is limited to resource exhaustion scenarios on systems with affected AMD GPU hardware.
No verified exploitation code is available. The issue was identified through static analysis rather than active exploitation research. See the upstream kernel patches for the precise code change details.
Detection Methods for CVE-2026-45976
Indicators of Compromise
- Unexplained growth in kernel slab memory consumption on systems with AMD GPUs
- Repeated amdgpu driver initialization failures in dmesg or journalctl -k output referencing RAS or NBIO subsystem errors
- Gradual reduction in available kernel memory without a corresponding workload change
Detection Strategies
- Audit running kernel versions against the patched commits 2fef8c2, 3f43e78, c11cd77, ee41e5b, and f8a5426 referenced in the upstream fix
- Monitor /proc/slabinfo and /proc/meminfo for sustained increases in kmalloc allocations after amdgpu module loads
- Inspect kernel logs for failures in amdgpu_ras_init() or amdgpu_nbio_ras_sw_init() paths
Monitoring Recommendations
- Establish baseline kernel memory metrics on AMD GPU hosts and alert on deviation
- Track driver load and unload events via auditd rules on the init_module and delete_module syscalls
- Forward kernel telemetry to a centralized log platform for correlation with hardware initialization errors
How to Mitigate CVE-2026-45976
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the kernel.org stable tree to all affected systems
- Track distribution security advisories and install vendor-supplied kernel updates as they become available
- Restrict the ability of unprivileged users to repeatedly trigger amdgpu module reinitialization
Patch Information
The upstream fix routes the failure path of amdgpu_nbio_ras_sw_init() through the release_con label so the allocated con structure is freed before returning the error code. The change is captured across multiple stable branch commits: Kernel Patch 2fef8c2, Kernel Patch 3f43e78, Kernel Patch c11cd77, Kernel Patch ee41e5b, and Kernel Patch f8a5426.
Workarounds
- Avoid repeated reload cycles of the amdgpu kernel module on systems where the patch cannot be applied immediately
- Schedule periodic reboots on long-running systems exhibiting kernel memory growth tied to AMD GPU initialization failures
- Investigate and resolve underlying hardware or firmware conditions that cause amdgpu_nbio_ras_sw_init() to fail, reducing the frequency at which the leak path is exercised
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
