CVE-2026-46276 Overview
CVE-2026-46276 is a Linux kernel vulnerability in the amdgpu Direct Rendering Manager (DRM) driver. The flaw triggers a kernel crash during modprobe of amdgpu on AMD RDNA4 (GFX 12) hardware, including the Radeon RX 9070 XT. RDNA4 hardware removes the Global Data Share (GDS), Global Wave Sync (GWS), and Ordered Append (OA) on-chip memory resources, leaving their sizes at zero. The amdgpu_ttm_init() function unconditionally registers Translation Table Manager (TTM) ranges for these resources, eventually calling drm_mm_init(mm, 0, 0) and tripping a DRM_MM_BUG_ON() assertion. The issue has been resolved in upstream Linux kernel stable branches.
Critical Impact
Local kernel crash (denial of service) during amdgpu module load on RDNA4 GPUs when CONFIG_DRM_DEBUG_MM is enabled.
Affected Products
- Linux kernel amdgpu DRM driver on RDNA4 (GFX 12) hardware
- AMD Radeon RX 9070 XT and other GFX 12 class GPUs
- Linux kernel builds compiled with CONFIG_DRM_DEBUG_MM enabled
Discovery Timeline
- 2026-06-08 - CVE-2026-46276 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-46276
Vulnerability Analysis
The vulnerability lives in the AMD GPU DRM driver's TTM initialisation path. RDNA4 (GFX 12) silicon physically removes the GDS, GWS, and OA on-chip scratch memories that prior generations exposed. The gfx_v12_0 init code accurately reflects this by leaving adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero.
The defect emerges because amdgpu_ttm_init() calls amdgpu_ttm_init_on_chip() for each resource without checking whether the size is non-zero. The helper forwards a zero-size range to ttm_range_man_init(), which invokes drm_mm_init(mm, 0, 0). The drm_mm_init() routine asserts DRM_MM_BUG_ON(start + size <= start), which is trivially true when both operands are zero, causing a kernel oops during driver probe.
The upstream fix returns early from amdgpu_ttm_init_on_chip() when size_in_page is zero, skipping TTM resource manager registration for absent hardware blocks. No other GPU generation is affected because they expose non-zero GDS/GWS/OA sizes.
Root Cause
The root cause is a missing zero-size guard in amdgpu_ttm_init_on_chip(). The function assumed every TTM range had a positive extent, which held for prior generations but became false on RDNA4 hardware that retires the GDS/GWS/OA memory pools entirely.
Attack Vector
This is a local reliability defect rather than a remotely exploitable flaw. Triggering the crash requires loading the amdgpu driver on RDNA4 hardware with a debug-enabled kernel. There is no known remote attack vector, no privilege escalation primitive, and no public proof-of-concept exploit.
The vulnerability mechanism is described in the upstream commit message; see the Linux Kernel Commit (5719ce58) and the Oops analysis report for technical details.
Detection Methods for CVE-2026-46276
Indicators of Compromise
- Kernel oops or panic logged during modprobe amdgpu on a system with an RDNA4 GPU such as the Radeon RX 9070 XT.
- Stack traces referencing drm_mm_init, ttm_range_man_init, amdgpu_ttm_init_on_chip, or DRM_MM_BUG_ON in dmesg or journalctl -k.
- Failed graphics initialisation on boot, with the system falling back to framebuffer or refusing to start a display server.
Detection Strategies
- Inventory Linux hosts running RDNA4-class AMD GPUs and identify which kernels were built with CONFIG_DRM_DEBUG_MM=y.
- Parse system logs for DRM_MM_BUG_ON assertions or amdgpu probe failures across the fleet.
- Track installed kernel versions against the fixed stable releases referenced in the upstream commit list.
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized log platform and alert on amdgpu initialization failures.
- Monitor configuration management telemetry for kernels shipping with debug DRM options on workstations using AMD RDNA4 hardware.
- Track GPU-dependent workloads (rendering, ML training) for unexpected node reboots correlated with driver load events.
How to Mitigate CVE-2026-46276
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the upstream fix referenced in the kernel.org commits.
- Verify whether production kernels are built with CONFIG_DRM_DEBUG_MM; disable it where the debug assertions are not needed.
- Defer deployment of RDNA4 GPUs on hosts running unpatched debug-enabled kernels.
Patch Information
The fix has been merged upstream and backported to multiple Linux stable trees. Affected commits include 095a8b0a, 0e21db1a, 1f5d33e7, 30c000a4, 36f9602f, 3e26c768, 9bc92575, and be0376af. Apply the kernel update from your Linux distribution vendor or rebuild from a patched stable tree.
Workarounds
- Rebuild the kernel with CONFIG_DRM_DEBUG_MM disabled to suppress the assertion until the patched kernel is deployed.
- Blacklist the amdgpu module on affected debug kernels and rely on alternative graphics paths until the system is updated.
- Roll back to a kernel build that has not enabled DRM memory manager debug assertions on systems that must keep RDNA4 hardware online.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
