Linux Kernel CVE-2026-46245

Local access is required (CVSS AV:L confirmed). The attacker must have low-privilege local authentication (CVSS PR:L confirmed - standard user account, not root). The target system must be running an AMD GPU with the amdgpu kernel driver loaded, as the vulnerable code path exists exclusively in the AMD DRM display subsystem. The NULL dereference is triggered only when HPD initialization encounters a display connector that lacks a valid dc_link pointer, which occurs in specific AMD GPU/connector configurations (e.g., analog connectors or connectors not fully enumerated by firmware). Exploitation is NOT possible remotely - the CVSS local attack vector is a hard constraint confirmed by the code path. No user interaction is required (UI:N). Systems without AMD GPU hardware, or with AMD GPUs where all connectors have valid dc_link pointers, are not affected.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the constrained attack surface: exploitation is local-only, requires low privileges, and the sole impact is availability loss (kernel crash / denial of service) with no confidentiality or integrity impact. The EPSS score of 0.02% at the 5th percentile strongly corroborates this assessment - exploitation is neither widespread nor automated. The vulnerability is not listed in CISA KEV, and no public exploit or POC has been identified. The practical risk is further bounded by hardware dependency: the vulnerable code path is only reached on systems with AMD GPUs where HPD initialization encounters connectors with a NULL dc_link. For AMD GPU deployments (workstations, servers with AMD display hardware, embedded AMD platforms), this is a valid kernel stability concern - a local user or process triggering GPU connector enumeration could force a kernel crash. For non-AMD GPU deployments, this CVE is irrelevant. Overall, this is a moderate-severity stability bug with low exploitation probability, appropriate for inclusion in routine kernel patching cycles rather than emergency response.

A local user with standard (low-privilege) access on a system running an unpatched Linux kernel with an AMD GPU loads or triggers re-initialization of the amdgpu display driver's HPD subsystem - for example, by modprobing the amdgpu module or initiating a display reconfiguration - causing amdgpu_dm_hpd_init() to iterate over connectors that include one with a NULL dc_link. The NULL dereference at dc_link->irq_source_hpd triggers a kernel oops or panic, resulting in a system crash or forced reboot. No public exploit code has been identified at time of analysis, and the scenario requires physical or SSH-level local access to the target system.