CVE-2024-46732

What it actually does

Failure to initialize linear_pitch_alignment in the AMD display driver causes a divide-by-zero when the code path executes under virtual machine conditions.

Why it matters to the business

Kernel panic or denial-of-service on Linux systems using AMD GPUs inside virtual machines, leading to workload interruption and potential data loss until the system is restarted or patched.

How an attack unfolds

An attacker with the ability to trigger display initialization or mode-setting operations inside a VM on an affected AMD GPU host can cause the uninitialized alignment value to be used in a division, crashing the kernel; listed threat actors have been observed targeting similar Linux kernel resource-handling flaws but no public exploit for this specific issue is known.

How to fix it

Update the Linux kernel to commit 4bd7710f2fecfc5fb2dda1ca2adc69db8a66b8b6 or a later stable release containing the fix; Syncthing users should upgrade to version 1.15.0 if that package is in scope.

How to confirm the fix worked

Confirm the running kernel contains commit 4bd7710f2fecfc5fb2dda1ca2adc69db8a66b8b6, then exercise AMD display code paths inside a VM and verify no divide-by-zero occurs.

Typical attack path

1. Obtain code execution or console access inside a VM running on an AMD GPU host
2. Trigger display driver initialization or pitch calculation routines
3. Force the linear_pitch_alignment variable to remain unset
4. Execute the division that uses the zero value, inducing a kernel crash

How to detect it

Review kernel logs for divide-by-zero faults originating from the amdgpu or drm display modules during VM display initialization; correlate with process activity that performs mode-setting or framebuffer allocation.

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts running virtual machines within the next patching cycle
• Monitor EPSS and KEV status for any future increase in exploit activity
• Test the fixed kernel in a staging VM environment before broad deployment