Linux Kernel CVE-2026-43318

Exploitation requires all of the following: (1) System with multiple AMD Radeon graphics cards using the AMDGPU kernel driver (not AMDGPU-PRO proprietary driver); (2) Multi-GPU configuration where peer-to-peer (P2P) PCI transfers are unavailable or disabled, forcing buffer migration through system memory; (3) Application or attacker code that explicitly shares graphics buffer objects across GPUs using DMA-BUF export/import mechanisms; (4) Precise timing where buffer migration is triggered (via move_notify callback) while a GPU command queue is actively executing operations on the shared buffer; (5) Local authenticated access with privileges sufficient to submit GPU work (typically standard user-level access to /dev/dri/renderD* device nodes). The attack is LIMITED by: local-only access vector (AV:L), requirement for authenticated low-privilege user (PR:L), need for specific AMD multi-GPU hardware configuration, and reliance on race condition timing that may not be reliably reproducible without deep understanding of kernel scheduling and GPU command queue behavior.

Real-world risk is LOW despite the MEDIUM CVSS 5.5 rating. Multiple limiting factors significantly reduce exploitation likelihood: (1) Attack vector is LOCAL only (AV:L), requiring authenticated access with low-level privileges (PR:L); (2) Vulnerability requires specific multi-GPU hardware configuration with AMD Radeon cards where P2P is unavailable or disabled; (3) Triggering conditions demand precise timing of buffer migration during active GPU command execution, making reliable exploitation complex (though AC:L suggests low attack complexity once conditions are met); (4) Impact is purely availability (A:H) with no confidentiality or integrity compromise, resulting in GPU hangs or application crashes rather than privilege escalation or data exposure; (5) EPSS score of 0.02% (5th percentile) indicates security researchers and attackers have shown minimal interest; (6) No CISA KEV listing and no public proof-of-concept identified. The SSVC decision framework suggests this is a deferrable priority: not automatable (requires specific hardware/timing), limited technical impact (localized DoS), and no evidence of active exploitation. Primary risk is operational disruption in professional graphics workstations or compute clusters using multiple AMD GPUs, not security compromise.

A local attacker with standard user privileges on a Linux workstation equipped with multiple AMD Radeon GPUs submits a graphics workload that deliberately shares buffer objects between GPUs while triggering buffer migration. By timing the buffer access pattern to coincide with active command queue execution on one GPU while forcing the kernel to migrate the shared buffer for access by the second GPU, the attacker causes premature page table invalidation. The running GPU job attempts to access the invalidated memory region, generating page faults that crash the graphics driver, freeze the GPU, or panic the kernel. This results in denial of service, disrupting all GPU-dependent applications including the graphical desktop environment, potentially requiring system reboot to restore functionality.