CVE-2024-26949

What it actually does

NULL pointer dereference in amdgpu power management code path when powerplay_table is uninitialized under SR-IOV virtualization, causing a kernel crash on power limit query.

Why it matters to the business

Unexpected system crashes and downtime on Linux servers or workstations using AMD GPUs in virtualized SR-IOV configurations, disrupting workloads until patched kernels are deployed.

How an attack unfolds

A local attacker with access to the affected system issues power management queries that reach the amdgpu driver before powerplay_table initialization, triggering the NULL dereference and kernel panic; no remote or unauthenticated path exists.

How to fix it

Upgrade to Linux kernel 6.7.12 or later, or apply the commit 99c2f1563b1400cc8331fc79d19ada1bb95bb388 in stable trees; rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the running kernel version is at or above 6.7.12, verify the amdgpu driver no longer skips powerplay_table checks under SR-IOV, and test power limit queries succeed without oops.

Typical attack path

1. Obtain local user access on a Linux system running an unpatched kernel with AMD GPU SR-IOV enabled
2. Trigger amdgpu power limit or OD value retrieval via userspace tools or direct sysfs access
3. Cause powerplay_table to remain NULL, dereference it, and induce kernel oops or panic

How to detect it

Search kernel logs and dmesg for amdgpu NULL pointer dereference or powerplay_table oops entries around the time of system instability; correlate with SR-IOV GPU usage.

• amdgpu: NULL pointer dereference
• powerplay_table
• get power limit

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts using SR-IOV within the next maintenance window
• Monitor kernel logs for amdgpu-related NULL dereference oops until patches are applied
• Restrict untrusted local accounts on systems that cannot be immediately updated