Skip to main content

Linux Kernel CVE-2026-31765

| EUVDEUVD-2026-26578 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-01 Linux
Denial Of Service Linux Null Pointer Dereference IBM Red Hat Amd Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    User login on 64KB-page system
  2. Delivery
    Execute rocminfo or GPU workload
  3. Exploit
    Trigger KFD VM initialization
  4. Install
    Request GPU memory allocation (128KB)
  5. C2
    Exceed reserved trap area (8KB)
  6. Execute
    Kernel page fault handling
  7. Impact
    NULL pointer dereference in mutex operations
  8. Step 8
    Kernel crash (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires: (1) system running Linux kernel version 6.9 to 6.19-rc4 (or affected earlier versions) with 64KB page size (POWER10, IBM pSeries, or similar ARM64/other architectures-not x86_64), (2) unprivileged local user account with shell access, (3) GPU workload execution capability (unprivileged users can often run rocminfo if amdgpu/kfd modules are loaded), and (4) AMD GPU hardware present with amdgpu and kfd kernel modules loaded. Workaround: restrict non-root access to GPU initialization via cgroups or disable amdgpu/kfd modules entirely. Limiting factors: architecture-specific (64KB pages only), requires local authentication, no remote or unauthenticated access vector, impact is denial of service to the affected process/system only (no privilege escalation or data breach).
Impact

This vulnerability presents low real-world risk despite moderate CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates local authenticated access is required-an attacker must have an unprivileged user account on the system and ability to execute rocminfo or GPU workloads. The impact is denial of service only (A:H); no confidentiality or integrity compromise occurs. The extremely low EPSS score (0.02%, percentile 5%) aligns with this assessment, suggesting minimal exploitation likelihood in practice. The vulnerability is architecture-specific, affecting only 64KB page-size systems (IBM POWER10, some ARM64, etc.), not the common x86_64 systems with 4KB pages where the bug does not manifest. No public exploit code exists, and no evidence of active exploitation appears in security feeds. Patch availability further reduces risk. The mismatch between CVSS (which focuses on technical exploitability) and EPSS (which considers real-world conditions) is expected here: high-CVSS but low-EPSS indicates a real defect that requires specific hardware and user action to trigger, making it lower priority than its CVSS alone suggests.
Exploit ScenarioDerived

An unprivileged user on a 64KB-page POWER10 system logs in and executes the rocminfo utility or initiates a ROCm GPU workload to initialize GPU memory. The kernel's KFD subsystem calls amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu to allocate 128KB for GPU context save/restore area (CWSR), but the reserved virtual address space is only 8KB. Allocation fails, triggering a kernel NULL pointer dereference in the mutex lock path, causing a kernel panic (Oops) and denial of service. The system crashes with 'BUG: Kernel NULL pointer dereference on read at 0x00000002'.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

Kernel NULL pointer dereference in AMD GPU driver on systems with 64KB page sizes allows local authenticated attackers to crash the system by triggering memory allocation mismatches between reserved trap area (8KB) and required allocation size (128KB) during GPU memory initialization. The vulnerability affects systems running ROCm workloads and causes denial of service when executing rocminfo or rccl unit tests on IBM POWER10 and similar 64K-page architectures. EPSS exploitation probability is very low (0.02%), and no public exploit code or active in-the-wild exploitation has been identified.

RemediationAI

Patch to a fixed kernel version: Linux 6.12.81, 6.18.22, 6.19.12, or 7.0 depending on branch (commit hashes: 6b2614a0ff05a2d2836311425091c8feca6f0c21, 77c918eaa4c916751769242567407f61c6af142a, d3508cf822c4d96d3e492210314f8f6f2da7df58, 4487571ef17a30d274600b3bd6965f497a881299). The fix changes AMDGPU_VA_RESERVED_TRAP_SIZE from 8KB to 64KB and adjusts KFD_CWSR_TBA_TMA_SIZE to use GPU page size, ensuring allocation size never exceeds reserved area. For systems unable to patch immediately, disable AMD GPU workload execution by unloading amdgpu and kfd kernel modules (trade-off: GPU functionality becomes unavailable) or restrict unprivileged user access to GPU via cgroups or SELinux policy (trade-off: may impact intended GPU users). Kernel rebuild with updated source is required; binary patches are not applicable. Patches are available via kernel.org stable branches-apply via normal distribution update mechanisms.

Affected VersionsENISA

Linux 34a1de0f79352086884553f78db271f957a98583 <4487571ef17a30d274600b3bd6965f497a881299
Linux patch: 0
Linux patch: 6.18.22
Linux 34a1de0f79352086884553f78db271f957a98583 <d3508cf822c4d96d3e492210314f8f6f2da7df58
Linux patch: 7.0
Linux patch: 6.12.81
Linux 34a1de0f79352086884553f78db271f957a98583 <6b2614a0ff05a2d2836311425091c8feca6f0c21
Linux patch: 6.19.12
Linux 6.9
Linux 34a1de0f79352086884553f78db271f957a98583 <77c918eaa4c916751769242567407f61c6af142a

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Linux kernel's AMD GPU driver (amdgpu/KFD subsystem) manages GPU virtual address space using reserved trap regions. The vulnerability stems from a hardcoded constant AMDGPU_VA_RESERVED_TRAP_SIZE set to 8KB, while the actual allocation size KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with 4KB pages, both values are 8KB and remain consistent. However, on 64KB page-size systems (POWER10, ARM64 variants), KFD_CWSR_TBA_TMA_SIZE expands to 128KB while the reserved trap area remains 8KB. This causes memory allocation attempts to exceed the reserved virtual address space, leading to kernel page fault handling errors. The root cause is CWE-476 (NULL pointer dereference), triggered when the kernel attempts to access memory at an invalid address (DAR: 0x00000002) during mutex operations in the GPU memory allocation path (amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu).

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
CVSS changed
May 11, 2026 - 17:52 NVD
5.5 (MEDIUM)
Patch available
May 01, 2026 - 16:33 EUVD
Patch released
May 01, 2026 - 15:24 nvd
Patch available
CVE Published
May 01, 2026 - 14:14 nvd
MEDIUM 5.5
CVE Published
May 01, 2026 - 14:14 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB

Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with 4K pages, both values match (8KB), so allocation and reserved space are consistent.

However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB, while the reserved trap area remains 8KB. This mismatch causes the kernel to crash when running rocminfo or rccl unit tests.

Kernel attempted to read user page (2) - exploit attempt? (uid: 1001) BUG: Kernel NULL pointer dereference on read at 0x00000002 Faulting instruction address: 0xc0000000002c8a64 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E 6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY Tainted: [E]=UNSIGNED_MODULE Hardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries NIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730 REGS: c0000001e0957580 TRAP: 0300 Tainted: G E MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268 XER: 00000036 CFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000 IRQMASK: 1 GPR00: c00000000125d908 c0000001e0957820 c0000000016e8100 c00000013d814540 GPR04: 0000000000000002 c00000013d814550 0000000000000045 0000000000000000 GPR08: c00000013444d000 c00000013d814538 c00000013d814538 0000000084002268 GPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff 0000000000020000 GPR16: 0000000000000000 0000000000000002 c00000015f653000 0000000000000000 GPR20: c000000138662400 c00000013d814540 0000000000000000 c00000013d814500 GPR24: 0000000000000000 0000000000000002 c0000001e0957888 c0000001e0957878 GPR28: c00000013d814548 0000000000000000 c00000013d814540 c0000001e0957888 NIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0 LR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00 Call Trace: 0xc0000001e0957890 (unreliable) __mutex_lock.constprop.0+0x58/0xd00 amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu] kfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu] kfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu] kfd_process_device_init_vm+0xd8/0x2e0 [amdgpu] kfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu] kfd_ioctl+0x514/0x670 [amdgpu] sys_ioctl+0x134/0x180 system_call_exception+0x114/0x300 system_call_vectored_common+0x15c/0x2ec

This patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve 64 KB for the trap in the address space, but only allocate 8 KB within it. With this approach, the allocation size never exceeds the reserved area.

(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
REF https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299 REF https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21 REF https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a REF https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy