CVE-2026-46245: Linux AMD Display Driver Null Pointer Dereference DoS Vulnerability

Technical summary

CVE-2026-46245 is a null pointer dereference in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c within the amdgpu_dm_hpd_init() function. The function iterates through display connectors and checks whether amdgpu_dm_connector->dc_link is valid before deciding whether to enable polling for analog connectors. However, the code later unconditionally dereferences dc_link when accessing its irq_source_hpd member without re-checking for null. A connector may have a null dc_link, triggering a kernel panic when the driver attempts HPD initialization. The fix involves assigning dc_link early and skipping connectors where it remains null, preventing the unsafe dereference.

Business impact

For organizations operating Linux systems with AMD GPUs, this vulnerability presents a denial of service risk. An unprivileged local user could trigger a kernel panic by exploiting the null pointer dereference during HPD initialization, causing system downtime. This is particularly relevant for desktop workstations, rendering farms, gaming systems, and data center nodes equipped with AMD graphics accelerators. The impact is elevated in headless or remote environments where system recovery may be delayed.

Affected systems

The Linux kernel versions containing this flaw specifically affect systems with AMD display drivers (amdgpu). The vulnerability is present in the DRM (Direct Rendering Manager) subsystem's AMD display code. Any Linux distribution running an affected kernel version with AMD GPU support enabled is potentially impacted. The precise range of affected versions should be verified against upstream Linux kernel release notes and your distribution's security advisories.

Exploitability

The vulnerability requires local access (AV:L) and standard user privileges (PR:L) to trigger. No user interaction is required (UI:N), and exploitation results in a kernel panic affecting the system under attack. The attack is straightforward—HPD initialization occurs during driver probe or connector enumeration, which may be triggered by device hotplug events, driver reloads, or system resume. This is not a remote vulnerability, but the low barrier to local exploitation means any unprivileged user on an affected system could cause a denial of service.

Remediation

Apply the patch that adds appropriate null checks for dc_link before dereference in the HPD initialization path. The fix involves assigning dc_link early and skipping connectors where dc_link is null, ensuring that irq_source_hpd is only accessed when the pointer is valid. Verify the patch version number in your distribution's security updates or upstream Linux kernel repositories. Alternatively, disable AMD GPU support in the kernel configuration if the GPU is not required, though this is typically not practical for affected systems.

Patch guidance

Monitor your Linux distribution's security advisories for a kernel update addressing CVE-2026-46245. This will typically be released as part of a kernel security patch series. Apply the update through your standard package management system (apt, yum, dnf, zypper, etc.). After applying the patch, reboot the system to activate the fixed kernel. For systems unable to reboot immediately, schedule maintenance during a low-impact window. Verify that HPD functionality still operates correctly post-patch.

Detection guidance

Monitor kernel logs for null pointer dereference panics originating from amdgpu_dm_irq.c or the amdgpu_dm_hpd_init() function. Use tools like journalctl on systemd systems or dmesg to review kernel messages. Look for stack traces mentioning amdgpu_dm or display-related code. Additionally, monitor systems for unexpected reboots or system hangs during GPU initialization or connector enumeration. Track kernel versions in use via uname -r and cross-reference against patched versions from your vendor.

Why prioritize this

Although the CVSS score is moderate (5.5), prioritization should be based on your environment's GPU utilization. Systems with AMD GPUs require prompt patching due to the local denial of service risk and ease of exploitation. For organizations without AMD GPUs, this vulnerability has lower priority. Desktop and workstation environments should treat this as higher priority than server environments without GPUs. The lack of KEV status indicates this has not yet been exploited in the wild, but the straightforward nature of the flaw warrants timely remediation.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects a local attack vector with low privileges required and high impact on availability (kernel panic). The vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly indicates that this is a local denial of service with no confidentiality or integrity impact. The score does not account for environmental factors such as the prevalence of AMD GPUs in your infrastructure or the criticality of affected systems. Consider raising priority if AMD GPU systems are critical to operations.

Frequently asked questions