Skip to main content

Linux Kernel CVE-2026-53135

| EUVDEUVD-2026-39340 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-mmv6-wm63-ppr6
Denial Of Service Linux Null Pointer Dereference Red Hat Amd Suse
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local privileged access
  2. Delivery
    Mount/access debugfs on AMD GPU system
  3. Exploit
    Trigger display hotplug event
  4. Execution
    Write to sdp_message debugfs node
  5. Persist
    Dereference NULL crtc pointer
  6. Impact
    Kernel panic / system crash

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all of the following: (1) local write access to the kernel's debugfs interface, specifically the sdp_message node under /sys/kernel/debug/dri/ - on most production Linux systems debugfs requires root or CAP_SYS_ADMIN, limiting this to privileged local accounts; (2) AMD GPU hardware with a DisplayPort-capable display connector present in the system; (3) the connector must be in the transient state of being connected but not yet bound to a CRTC, which occurs after a hotplug event and before the next atomic modeset commit. The buffer over-read path is triggered independently by writing fewer than 36 bytes to the node, requiring only conditions (1) and (2). Exploitation is not possible remotely, not possible without AMD display hardware, and not possible without some form of local privilege to access debugfs. The transient connector state for the NULL deref path introduces a timing dependency that further narrows reliable triggering.
Impact

Real-world risk is constrained by multiple limiting factors despite the A:H (Availability: High) CVSS rating. EPSS at 0.18% (7th percentile) reflects the community's low expectation of exploitation; no KEV listing or public exploit code is identified. The CVSS vector AV:L/AC:L/PR:L requires local access, and on the vast majority of production Linux deployments debugfs is either not mounted or restricted to root/CAP_SYS_ADMIN, meaning PR:L may overstate accessibility. An additional hardware prerequisite - an AMD GPU with a connected DisplayPort display in the specific transient post-hotplug state - further narrows the exploitable population. The impact is limited to a kernel panic (DoS); there is no confidentiality or integrity impact. The primary risk is in workstation or kiosk environments running AMD GPU hardware with debugfs exposed, or in development/test environments. Enterprise servers typically do not expose debugfs to unprivileged users and often lack AMD display hardware, making this low operational priority outside AMD GPU workstation deployments.
Exploit ScenarioDerived

A local user with write access to the kernel's debugfs filesystem (e.g., /sys/kernel/debug/dri/0/sdp_message) on a system with an AMD GPU writes fewer than 36 bytes to the sdp_message node immediately after a display hotplug event before the compositor performs an atomic commit. The kernel dereferences the NULL crtc pointer in dp_sdp_message_debugfs_write(), triggering a NULL pointer dereference kernel oops and crashing the system. No public exploit code exists; the scenario is straightforward to replicate manually but requires physical or privileged access.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 07, 2026

NULL pointer dereference and buffer over-read in the Linux kernel's AMD display driver (drm/amd/display) can be triggered by a local user writing to the sdp_message debugfs node, causing a kernel panic and denial of service. The dp_sdp_message_debugfs_write() function fails to check whether connector->base.state->crtc is NULL - a valid transient state after GPU hotplug before an atomic commit - and unconditionally passes 36 bytes to copy_from_user() regardless of the caller-provided size, enabling a second over-read path. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), consistent with a localized, hardware-dependent DoS.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version for the applicable stable branch: 5.10.259 or later, 5.15.210 or later, 6.1.176 or later, 6.6.143 or later, 6.12.94 or later, 6.18.36 or later, 7.0.13 or later, or 7.1 final. Upstream fix commits are available at https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f and related stable-tree commits listed in references. Distribution vendors (RHEL, Ubuntu, SUSE, Debian) should be tracked for kernel update advisories incorporating these upstream commits. As a compensating control where patching is not immediately possible, restricting debugfs mount access (e.g., mounting debugfs with nosuid and access controls, or not mounting it on production systems: umount /sys/kernel/debug) eliminates the attack surface entirely with no functional impact on workloads that do not use debugfs. Alternatively, blocking write access to /sys/kernel/debug/dri/*/sdp_message via filesystem permissions or seccomp policy removes this specific path. Unloading the amdgpu kernel module is an aggressive workaround that disables AMD display functionality entirely.

Affected VersionsENISA

Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <7ae95c0275c330b5dbae806f8e431720edad776f
Linux 5.2
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <adf67034b1f61f7119295208085bfd43f85f56af
Linux patch: 7.0.13
Linux patch: 0
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <bb6f705b73b5f191f14ad004e2c8c4b615806187
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <c90954cdea4d6998ec345de0d840d030c145b89e
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <ee9cfcf77a8e8af637396dc00966df5f701e661c
Linux patch: 6.12.94
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <a2de1d71891a038a9346b2c1a72b88c8350f2479
Linux patch: 5.10.259
Linux patch: 6.1.176
Linux patch: 6.18.36
Linux patch: 7.1
Linux patch: 5.15.210
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <b781f90a9528555c709e59789550893581ef0be4
Linux c7ba3653e9773256b2b08508a2ed2ca28ea7566b <7fc4fab4acc307ad2903312c195872b2953d32c3
Linux patch: 6.6.143

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Direct Rendering Manager (DRM) AMD display subsystem within the Linux kernel (CWE-476, NULL Pointer Dereference). The affected function dp_sdp_message_debugfs_write() is exposed via the kernel's debugfs virtual filesystem and handles Secondary Data Packet (SDP) messages for DisplayPort connections. Two distinct coding errors are present: first, the function dereferences connector->base.state->crtc without a NULL guard, which is reachable when a display connector has been hotplugged but not yet assigned to a CRTC through an atomic modeset commit - a normal intermediate kernel state. Second, the function ignores the 'size' parameter passed by the caller and always invokes copy_from_user() with a hardcoded 36-byte count, reading beyond the user-provided buffer when size < 36. The CPE data confirms the affected component is cpe:2.3:o:linux:linux_kernel across multiple stable branches. Both defects were introduced from commit c7ba3653e977 and are fixed by cherry-pick of upstream commit 6ab4c36a5228.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.1 MEDIUM

Debugfs writes require root/CAP_SYS_ADMIN on hardened systems (PR:H); NULL deref path needs specific hotplug timing state (AC:H); no C/I impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 07, 2026 - 17:07 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

[Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node.

The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36.

Fix both issues by:

  • Returning -ENODEV when connector->base.state or state->crtc is NULL
  • Clamping write_size to min(size, sizeof(data))

(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Ubiquitous
Linux kernel runs majority of servers, embedded, and cloud infrastructure
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53135 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/373678 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f REF https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3 REF https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479 REF https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af REF https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4 REF https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187 REF https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e REF https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy