CVE-2026-53325: Linux AMD64 AGP Driver NULL Pointer Dereference in Virtual Environments

Technical summary

CVE-2026-53325 is a NULL pointer dereference vulnerability in the AMD64 AGP driver (drivers/char/agp/amd64-agp.c). The root cause is improper error checking in agp_amd64_probe(). When cache_nbs() returns -ENODEV (indicating no AMD northbridges are present), the probe function incorrectly checks if the return value equals exactly -1 rather than checking for any negative error code. This allows the driver to proceed with initialization despite missing hardware. Subsequent calls to amd64_fetch_size() invoke node_to_amd_nb(0), which returns NULL in the absence of physical hardware. Dereferencing this NULL pointer to access the ->misc member triggers a General Protection Fault (GPF).

Business impact

This vulnerability primarily affects virtualized workloads and cloud deployments running on AMD-based infrastructure. In affected environments, the kernel crash causes denial of service—system downtime, interrupted workloads, and potential data loss if the crash occurs during critical operations. Organizations relying on Linux VMs in KVM/QEMU environments are at highest risk. The impact is localized to the affected system; there is no remote exploitation vector.

Affected systems

The vulnerability impacts Linux kernel installations that include the AMD64 AGP driver. Affected systems typically run on AMD-based hardware or emulation in virtualized environments (KVM, QEMU, hypervisors). The issue manifests primarily in virtual machines without emulated AMD northbridge hardware. Systems without AMD graphics or in non-virtualized environments with proper hardware detection may not be affected in practice, though the driver may still be loaded.

Exploitability

Exploitability is low. The vulnerability requires local access and execution context on the affected system. An unprivileged local user cannot trigger the crash directly; it occurs during kernel initialization or driver probe when the system boots or when the driver is loaded. The crash is deterministic in virtualized environments without the requisite hardware but does not provide privilege escalation or code execution—only a denial of service via kernel panic.

Remediation

Apply kernel updates that include the fix for agp_amd64_probe(). The fix modifies the error-checking logic to properly detect all negative return codes from cache_nbs(), not just -1, ensuring the driver aborts initialization when hardware is absent. Organizations should prioritize kernel updates for virtualized Linux systems running AMD-based infrastructure. Verify the specific patched kernel version against your Linux distribution's security advisories.

Patch guidance

Update to a Linux kernel version that includes the corrected agp_amd64_probe() error handling. Check your distribution's kernel update channels (e.g., linux-image packages for Debian/Ubuntu, kernel packages for RHEL/CentOS) for patched versions. The fix is minimal and low-risk—it prevents incorrect initialization rather than changing active code paths. Test the update in a non-production environment first to confirm stability in your virtualization stack.

Detection guidance

Kernel logs will show a General Protection Fault (GPF) or Oops message referencing amd64_fetch_size() or agp_amd64_probe() when the vulnerability is triggered. Monitor system logs (dmesg, /var/log/kern.log) for AGP driver initialization errors or NULL pointer dereference messages. Virtualized environments that report unexpected kernel panics during boot on AMD hardware warrant investigation. No user-space application changes or runtime detection methods are effective; kernel version assessment is the primary detection method.

Why prioritize this

This vulnerability merits medium priority in virtualized environments but lower priority for traditional bare-metal systems. Organizations running significant Linux workloads in KVM/QEMU on AMD hardware should patch promptly to prevent unexpected service disruptions. The CVSS score of 5.5 (Medium) reflects the local-access requirement and denial-of-service impact. It does not pose an existential security risk but does impact availability in vulnerable deployments.

Risk score, explained

The CVSS:3.1 score of 5.5 (Medium) reflects: local attack vector (AV:L) requiring system-level access, low complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), unchanged scope (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H). The score appropriately captures a local denial-of-service condition with no privilege escalation or data exposure, typical for kernel stability bugs in specific hardware configurations.

Frequently asked questions