CVE-2026-43369 in Linux
Summary
by MITRE • 05/08/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd: Fix NULL pointer dereference in device cleanup
When GPU initialization fails due to an unsupported HW block IP blocks may have a NULL version pointer. During cleanup in amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and amdgpu_device_set_cg_state which iterate over all IP blocks and access adev->ip_blocks[i].version without NULL checks, leading to a kernel
NULL pointer dereference.
Add NULL checks for adev->ip_blocks[i].version in both
amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent dereferencing NULL pointers during GPU teardown when initialization has failed.
(cherry picked from commit b7ac77468cda92eecae560b05f62f997a12fe2f2)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
This vulnerability represents a critical null pointer dereference flaw in the AMD GPU driver component of the Linux kernel, specifically within the direct render manager subsystem. The issue manifests during device cleanup operations when GPU initialization has previously failed, creating a scenario where hardware block IP components may possess NULL version pointers. This condition directly violates the fundamental principle of defensive programming and represents a classic example of improper null pointer handling that can lead to system crashes and potential security implications.
The technical flaw occurs within the amdgpu_device_fini_hw function where the driver attempts to clean up GPU resources after initialization failure. During this cleanup process, the code invokes two functions amdgpu_device_set_pg_state and amdgpu_device_set_cg_state which are responsible for setting power gating and clock gating states respectively. These functions iterate through all IP blocks in the device structure and access the version pointer without proper null checks, specifically targeting adev->ip_blocks[i].version. This pattern directly corresponds to CWE-476 which identifies null pointer dereference as a dangerous programming error that can result in system instability and potential privilege escalation.
The operational impact of this vulnerability is significant as it can cause kernel panics and system crashes when GPU devices fail during initialization and subsequent cleanup operations. Attackers could potentially exploit this weakness to cause denial of service conditions, particularly in environments where GPU initialization failures might be induced through malicious input or hardware manipulation. The vulnerability affects systems running Linux kernels with AMD GPU support, making it relevant to a wide range of computing environments including servers, desktops, and embedded systems. From an ATT&CK perspective, this represents a privilege escalation vector through system instability, potentially enabling adversaries to disrupt normal system operations or create conditions for more sophisticated attacks.
The fix implemented addresses this vulnerability by adding explicit null pointer checks before accessing the version pointer in both affected functions. This defensive programming approach prevents the kernel from attempting to dereference NULL pointers during cleanup operations, thereby maintaining system stability. The solution follows established security practices for handling potentially uninitialized data structures and represents a straightforward but critical patch that resolves the immediate threat without altering the core functionality of the GPU driver. The fix demonstrates proper error handling methodology and aligns with kernel security best practices by ensuring that all pointer accesses are validated before use, preventing the propagation of null reference errors that could compromise system integrity.
This vulnerability classification places it within the realm of kernel-level memory safety issues that require careful handling during device lifecycle management. The fix represents a typical remediation for improper null pointer dereference scenarios and underscores the importance of robust error handling in kernel space code where such flaws can have catastrophic consequences. The vulnerability serves as a reminder of the critical nature of proper resource management in operating system components and the necessity of thorough testing for error conditions, particularly in device driver code where hardware initialization failures are common occurrences.