CVE-2026-53316: Linux Kernel AMD RAS NULL Pointer Dereference Denial of Service

Technical summary

CVE-2026-53316 is a NULL pointer dereference (CWE-476) in the drm/amd/ras subsystem of the Linux kernel. The vulnerability occurs in the ras_core_ras_interrupt_detected() function when ras_core is NULL but the code attempts to dereference ras_core->dev in the error handling path. An unprivileged local user can trigger this condition, leading to a kernel panic and denial of service. The issue was identified through static analysis by Dan Carpenter.

Business impact

This vulnerability impacts system availability. A local attacker can crash the kernel or cause service disruption on systems running vulnerable Linux kernels with AMD RAS support enabled. While it requires local access and standard user privileges, successful exploitation results in immediate denial of service. For organizations running Linux servers with AMD hardware and the RAS subsystem active, this represents a practical availability risk that could disrupt operations or enable malicious service interruption by lower-privileged users.

Affected systems

The vulnerability affects the Linux kernel. Systems running Linux with AMD RAS driver support are vulnerable. This includes many modern Linux distributions running affected kernel versions. The specific kernel versions containing this flaw should be verified against vendor release notes, as the CVE record does not enumerate specific version numbers.

Exploitability

Exploitability is moderate. The vulnerability requires local access to the affected system and can be triggered by any user with standard privileges (PR:L in the CVSS vector). No authentication, user interaction, or special privileges are needed beyond basic local shell access. However, exploitation requires precise conditions: the ras_core object must be NULL when ras_core_ras_interrupt_detected() is called, which may depend on driver initialization state or hardware configuration. Public exploit code availability is not confirmed.

Remediation

Apply a kernel update that includes the fix for drm/amd/ras. Verify the specific patch version against your Linux distribution's security advisory. The fix addresses the NULL pointer check by ensuring ras_core is validated before dereferencing ras_core->dev in the error path. For organizations unable to immediately patch, consider disabling the AMD RAS subsystem at boot if not required for operations.

Patch guidance

Identify your Linux kernel version using 'uname -r' and check your distribution's security advisory for the patched kernel version addressing CVE-2026-53316. Major distributions (Red Hat, Canonical, SUSE, etc.) typically release patched kernels within their standard update cycles. Prioritize kernel updates for systems with AMD hardware where the RAS driver is actively used. Test patches in a non-production environment before widespread deployment to ensure compatibility with your workloads.

Detection guidance

Monitor kernel logs for NULL pointer dereference panics originating from the drm/amd/ras subsystem. On systems with persistent logging, search for stack traces containing 'ras_core_ras_interrupt_detected' or similar RAS driver function names. Network-based detection is not applicable for local kernel crashes. Host-based intrusion detection systems configured to monitor for kernel panic events can alert on exploitation attempts. Correlation with user login events and privilege escalation attempts may help identify malicious intent.

Why prioritize this

Although the CVSS score is medium (5.5), prioritize patching due to ease of exploitation (local, no special privileges required) and direct impact on system availability. Local denial-of-service vulnerabilities are often underestimated but can enable attackers to disrupt critical services or be chained with other vulnerabilities. Organizations running AMD-based Linux infrastructure should treat this as a higher priority than the CVSS score alone suggests.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), but high availability impact (A:H). The score appropriately captures that only local users can exploit this and that the sole impact is availability. However, the practical risk is elevated due to how easily a local attacker can trigger denial of service.

Frequently asked questions