CVE-2026-53315: Linux Kernel AMD RAS NULL Pointer Dereference

Technical summary

CVE-2026-53315 addresses a NULL pointer dereference vulnerability in the Linux kernel's drm/amd/ras driver module. The function ras_core_get_utc_second_timestamp() retrieves UTC timestamps via a platform-specific RAS (Reliability, Availability, Serviceability) callback. While the function conditionally checks ras_core before invoking sys_fn, the error path that executes when the condition fails attempts to dereference ras_core->dev without validating ras_core itself. This creates a use-after-check scenario where a NULL ras_core pointer can lead to an immediate kernel panic. The mitigation involves inserting an early NULL check and returning zero on failure, ensuring ras_core is validated before any member access.

Business impact

This vulnerability impacts system stability on Linux systems running affected kernel versions with AMD RAS driver support enabled. Although the flaw is local-only and requires existing system access to trigger, a denial-of-service condition affecting critical infrastructure relying on reliable kernel uptime poses operational risk. Systems actively monitoring hardware errors or deployed in high-availability environments where unexpected kernel panics incur service loss should treat this with higher urgency. The impact is limited to crash scenarios; no privilege escalation, data corruption, or remote attack vector exists.

Affected systems

The Linux kernel is the sole affected product. Specific kernel versions are not enumerated in the advisory; verify against the official Linux kernel security bulletins and your vendor's release notes to identify which versions in your environment contain this defect. Systems running AMD GPU drivers (particularly those with RAS monitoring enabled) are most likely to exercise this code path.

Exploitability

This vulnerability requires local system access and cannot be exploited remotely. It is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. A local, unprivileged user can likely trigger the crash through RAS error monitoring interfaces if they have read/write access to relevant sysfs or device interfaces. The attack surface is limited to administrative or monitoring tools that invoke RAS timestamp functions.

Remediation

Apply a Linux kernel update that includes the fix for CVE-2026-53315. The remediation adds an explicit NULL pointer check at the function entry point, eliminating the problematic dereference. Verify against the official Linux kernel advisory and your distribution's security updates for specific patch versions. For systems unable to update immediately, limit local user access to RAS monitoring interfaces if feasible, though this may reduce observability of hardware errors.

Patch guidance

Patches are available through official Linux kernel distribution channels. Check your kernel maintainer's security advisory for the fixed kernel version specific to your branch (mainline, stable, or long-term support). Most major Linux distributions will backport this fix to their maintained kernel versions. Apply the update during a maintenance window, as kernel updates typically require a reboot. Verify the patched kernel includes the change to add an early return-zero path in ras_core_get_utc_second_timestamp().

Detection guidance

Monitor kernel logs for NULL pointer dereference panics involving the ras_core or drm/amd/ras modules. Watchdog or core dump analysis may show a crash originating from ras_core_get_utc_second_timestamp(). If your environment captures kernel oops or panic events, search for function names and module references matching the RAS driver. Additionally, review system uptime metrics for unexpected reboots on AMD GPU–equipped nodes, which may indicate this crash occurring and auto-recovery.

Why prioritize this

Assign medium priority. CVSS 5.5 reflects local-only access requirement and denial-of-service impact. While not a critical vulnerability, unplanned system crashes in production environments degrade availability and should not be ignored. Prioritize systems in high-availability clusters, hardware monitoring appliances, and environments where kernel stability is a compliance or operational requirement. Non-critical development and testing systems can be addressed in routine maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium severity) is driven by: Attack Vector = Local (AV:L, eliminating remote exploitation), Attack Complexity = Low (AC:L, no special conditions needed), Privileges Required = Low (PR:L, standard user access sufficient), User Interaction = None (UI:N), and Impact = High Availability loss (A:H) but no Confidentiality or Integrity impact (C:N, I:N). The score accurately reflects that this is a stability threat with local scope, not a privilege escalation or data breach vector.

Frequently asked questions