CVE-2023-52738

What it actually does

The vulnerability is a NULL pointer dereference in drm_sched_fini triggered when amdgpu_fence_driver_sw_fini calls it without a prior successful drm_sched_init for the ring, due to probe failure handling paths.

Why it matters to the business

Kernel crashes and failed GPU driver initialization on affected AMD hardware can cause system instability or boot failures in Linux environments, increasing operational downtime risk for graphics workloads though remote exploitation is not feasible.

How an attack unfolds

An attacker would need local access to induce specific driver probe failure conditions during amdgpu initialization that bypass the sched.ops readiness check, leading to the oops in drm_sched_fini; no known threat actors or campaigns are associated.

How to fix it

Update the Linux kernel to include commit 2e557c8ca2c585bdef591b8503ba83b85f5d0afd which adds a check for sched.ops before calling drm_sched_fini in the fence driver sw fini routine.

How to confirm the fix worked

Confirm the patch is applied by verifying the presence of the sched.ops check in amdgpu_fence_driver_sw_fini and test driver probe failure scenarios to ensure no oops occurs.

Typical attack path

1. Cause amdgpu driver probe to fail (e.g., hardware or initialization error)
2. Trigger amdgpu_device_fini_sw which calls amdgpu_fence_driver_sw_fini
3. Invoke drm_sched_fini without prior successful drm_sched_init resulting in NULL dereference

How to detect it

Search kernel logs and dmesg output for 'BUG: kernel NULL pointer dereference' combined with 'drm_sched_fini' and 'amdgpu_fence_driver_sw_fini' during probe failure events.

• BUG: kernel NULL pointer dereference.*drm_sched_fini
• amdgpu: probe of.*failed with error
• amdgpu_fence_driver_sw_fini+0xc8

What your security team should do

• Apply the fixed kernel commit immediately on systems with AMD GPUs
• Monitor kernel logs for amdgpu probe failures and drm_sched_fini oops patterns
• Prioritize updates on high-availability or graphics-intensive deployments