CVE-2024-46803

What it actually does

Race condition between debug_trap_disable and a pending workqueue task that writes to dbg_ev_file results in NULL pointer dereference when the file pointer is cleared before the deferred write executes.

Why it matters to the business

Systems using AMD GPUs for compute workloads may experience kernel crashes or instability; low exploitability and no ransomware usage reduce immediate operational risk, though widespread Linux kernel deployments increase exposure surface.

How an attack unfolds

An attacker with local access triggers rapid enable/disable of debug traps on an AMD KFD device; the workqueue scheduled in interrupt context continues after dbg_ev_file is set to NULL, dereferencing the pointer and causing a crash. Mentioned threat actor campaigns targeting Linux kernel resource issues provide context but no public exploit for this specific flaw exists.

How to fix it

Update the Linux kernel to commit e6ea3b8fe398915338147fe54dd2db8155fdafd8 or later stable releases that cancel the debug_event_workarea before clearing dbg_ev_file; apply vendor backports for supported distributions.

How to confirm the fix worked

Verify kernel source contains the cancel_work_sync call before dbg_ev_file=NULL assignment; boot patched kernel and confirm no NULL dereference under rapid trap enable/disable stress; check /proc/version or uname output against fixed commit hashes.

Typical attack path

1. Obtain local user access on affected Linux system with AMD GPU
2. Load or interact with amdkfd driver to enable debug trap
3. Rapidly disable debug trap while work item is queued
4. Trigger NULL pointer dereference via pending dbg_ev_file write
5. Cause kernel panic or denial of service

How to detect it

Review kernel logs for amdkfd-related NULL pointer dereference or workqueue warnings around debug trap operations; correlate with process activity that interacts with /dev/kfd and debug event files.

What your security team should do

• Prioritize patching kernel on GPU compute nodes within standard maintenance windows given low EPSS
• Monitor for kernel oops or panic logs referencing amdkfd and dbg_ev_file
• Limit untrusted local access to systems exposing KFD debug interfaces until updated