Linux Kernel CVE-2026-43337

Requires local authenticated access (PR:L per CVSS vector) to a Linux system running kernel versions 6.12 through 7.0-rc6. System must be equipped with AMD GPU hardware using the DCN 4.01 display controller and the amdgpu kernel driver loaded. Exploitation occurs during hardware initialization paths in the display driver, specifically when freq_changed condition is true but the update_bw_bounding_box callback pointer is NULL. This can happen during normal system operations involving display frequency changes, power management events, or display reconfiguration. Does not require root privileges or non-default kernel configurations. Attack complexity is low (AC:L) and requires no user interaction beyond the attacker's own actions. Limiting factors include the narrow kernel version range (primarily recent development kernels and release candidates rather than stable LTS versions deployed in most production environments), requirement for specific AMD hardware, and restriction to local access only - remote exploitation is not possible (AV:L).

Real-world risk is low despite the CVSS base score of 5.5 (Medium). The CVSS vector AV:L/AC:L/PR:L/UI:N indicates local access with low attack complexity but requires authenticated user privileges, significantly limiting attack surface. The EPSS score of 0.02% (4th percentile) confirms minimal observed exploitation likelihood in the wild. Not present in CISA KEV, indicating no confirmed active exploitation. The vulnerability requires specific hardware (AMD GPUs with DCN 4.01 display controllers) and kernel versions (6.12-7.0-rc6), further narrowing the affected population. Impact is limited to availability (A:H in CVSS) with no confidentiality or integrity compromise - attackers can only trigger denial of service, not gain elevated privileges or access data. The narrow affected version range (recent kernels and release candidates) means most production systems running stable LTS kernels are unaffected. Vendor response was rapid with patches integrated into stable branches within the same development cycle. Priority should be moderate for organizations running affected kernel versions on AMD hardware, low for others. The attack requires local authenticated access, making this primarily an insider threat or post-compromise persistence mechanism rather than an initial access vector.

A local authenticated user on a Linux system with an AMD GPU using DCN 4.01 display controller triggers the vulnerability by causing a frequency change event during display hardware initialization while the update_bw_bounding_box callback is uninitialized. This could occur through legitimate operations like changing display configurations, switching power states, or during system resume from suspend. The NULL pointer dereference crashes the kernel, causing immediate system denial of service and requiring a reboot. No public exploit code identified at time of analysis, but exploitation requires only standard user privileges and basic knowledge of display subsystem interactions.