CVE-2026-53315: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53315 Overview

CVE-2026-53315 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU Reliability, Availability, and Serviceability (RAS) subsystem. The flaw resides in the ras_core_get_utc_second_timestamp() function within the drm/amd/ras driver. This function retrieves UTC timestamps used to record RAS error events on AMD graphics hardware. The function evaluates ras_core in a conditional check before invoking the sys_fn callback. When the check fails, the error path dereferences ras_core->dev without validating that ras_core itself is non-NULL, triggering a kernel NULL pointer dereference [CWE-476].

Critical Impact
A NULL dereference in the AMD RAS driver can crash the kernel and cause denial of service on systems using affected AMD GPU hardware.

Affected Products

Linux kernel builds containing the drm/amd/ras subsystem prior to the upstream fix
Systems using AMD GPU hardware with RAS error reporting enabled
Distributions shipping the affected ras_core_get_utc_second_timestamp() implementation

Discovery Timeline

2026-06-26 - CVE-2026-53315 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53315

Vulnerability Analysis

The ras_core_get_utc_second_timestamp() function in the AMD Direct Rendering Manager (DRM) RAS driver returns the current UTC time in seconds since the Unix epoch. RAS uses this timestamp to record when hardware error events occur. The function calls a platform-specific sys_fn callback registered by the RAS core to obtain the timestamp value.

The defect is a classic ordering error in defensive checks. The conditional guard validates internal state before invoking sys_fn, but the error branch calls a logging routine that accesses ras_core->dev. If ras_core is NULL at entry, the logging call dereferences a NULL pointer and triggers a kernel oops. The fix adds an early NULL check for ras_core at the start of the function and returns 0 when the pointer is invalid, preventing the dereference and clarifying control flow.

Root Cause

The root cause is missing pointer validation before use in the error path. The function assumes ras_core is valid when constructing an error message, but no invariant guarantees this at the call site. Under conditions where the RAS core is not yet initialized or has been torn down, the pointer can be NULL when timestamping is requested.

Attack Vector

The vulnerability is reachable only through kernel code paths that request a RAS timestamp when the RAS core is not initialized. This limits exploitation to local conditions on systems with AMD GPU hardware and RAS enabled. The primary security impact is denial of service via kernel crash rather than privilege escalation or information disclosure.

No verified public proof-of-concept code is available. See the upstream patch commit and the follow-up commit for the technical fix.

Detection Methods for CVE-2026-53315

Indicators of Compromise

Kernel oops or panic messages referencing ras_core_get_utc_second_timestamp in dmesg or /var/log/kern.log
NULL pointer dereference stack traces originating in the amdgpu or drm/amd/ras modules
Unexpected GPU driver resets or system reboots on hosts with AMD RAS reporting enabled

Detection Strategies

Inventory Linux hosts running kernel versions that predate the two upstream fix commits referenced above
Correlate kernel crash telemetry with AMD GPU hardware presence and CONFIG_DRM_AMD_RAS build options
Review distribution security trackers for backport status of the fix in long-term support kernels

Monitoring Recommendations

Forward kernel.log and dmesg output to a centralized logging platform for anomaly review
Alert on repeated BUG: unable to handle NULL pointer dereference entries from GPU-related modules
Track kernel package versions across the fleet and flag hosts still running vulnerable builds

How to Mitigate CVE-2026-53315

Immediate Actions Required

Apply the upstream Linux kernel patches from 2b8101cc3b34 and 6c84f7f0afc4 or install a distribution kernel that includes these commits
Prioritize patching on hosts with AMD GPUs used for compute, virtualization, or workstation workloads where RAS is enabled
Reboot affected hosts after kernel upgrade to activate the fixed image

Patch Information

The fix adds an early NULL check for ras_core at the beginning of ras_core_get_utc_second_timestamp() and returns 0 when the pointer is invalid. The change is available in the upstream stable tree via commits 2b8101cc3b34 and 6c84f7f0afc4. Verify your distribution vendor has backported both commits before considering a system remediated.

Workarounds

Where patching is not immediately possible, disable AMD RAS reporting on non-critical systems by unloading or blacklisting related kernel modules
Restrict local access on affected hosts to reduce the chance of triggering the vulnerable code path
Monitor kernel logs closely and schedule remediation windows if AMD GPU RAS features are required

bash

# Verify installed kernel version and check for the fix
uname -r

# Debian/Ubuntu: update kernel to a fixed build
sudo apt update && sudo apt install --only-upgrade linux-image-generic

# RHEL/Rocky/Alma: update kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot