CVE-2026-98898 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it.
(cherry picked from commit bd018d36171a695952c6d391471c279c9e05c8b2)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel driver for AMD graphics processing units, specifically within the power management subsystem known as drm/amd/pm/si, contained a logic error related to thermal monitoring initialization. This vulnerability arises when Dynamic Power Management is explicitly disabled via the amdgpu.dpm=0 module parameter during system boot or driver loading. Under normal operational conditions, the kernel initializes various hardware-specific work queues and structures required for dynamic frequency scaling and thermal throttling. However, in this specific configuration where DPM is turned off, the code path responsible for initializing the thermal work queue was skipped to optimize performance or reduce overhead. The flaw lies in the subsequent execution flow which did not adequately check whether this initialization had actually occurred before attempting to schedule thermal monitoring tasks.
The technical consequence of this oversight is a potential null pointer dereference or use-after-free scenario, depending on how the uninitialized memory state interacts with the kernel scheduler. When the system attempts to schedule work on an unallocated or invalid queue structure, it can lead to a kernel panic, resulting in an immediate system crash and denial of service for all users and processes running on that machine. This type of defect is characteristic of improper initialization checks where software assumes certain subsystems are active without verifying their state against the current configuration parameters. It represents a failure in defensive programming practices within the driver's core logic path.
From a security perspective, this vulnerability aligns with CWE-476 which describes NULL Pointer Dereference vulnerabilities. Although it primarily impacts system stability rather than allowing direct remote code execution or privilege escalation under typical circumstances, local denial of service is a significant risk for systems relying on stable uptime. In the context of the MITRE ATT&CK framework, this behavior can be associated with T1499 Endpoint Denial of Service, as an attacker who has the ability to load kernel modules or modify boot parameters could potentially trigger this condition intentionally to disrupt system availability. The impact is confined to local users with sufficient privileges to alter driver loading configurations, limiting its exploitability in multi-tenant environments without prior access control bypasses.
Mitigation for this issue involves applying the specific patch that ensures the thermal work queue initialization status is verified before any scheduling operations are attempted. System administrators should ensure their kernels are updated to include this fix from commit bd018d36171a695952c6d391471c279c9e05c8b2 or later versions of the stable Linux tree. For environments where DPM is intentionally disabled for performance reasons, it is critical to verify that all dependent subsystems handle this state gracefully without assuming default initialization sequences are present. Regular kernel updates and adherence to vendor security advisories remain the primary defense against such logic flaws in low-level system drivers.