CVE-2024-46819

What it actually does

Null pointer dereference in AMD GPU NBIO v7.4 error reporting path when ras_manager object is absent, allowing a warning to dereference a null object and potentially corrupt kernel memory or trigger a crash.

Why it matters to the business

Systems using affected Linux kernels with AMD GPUs may experience unexpected reboots, service interruptions, or reduced availability; widespread kernel deployment increases exposure across servers and workstations.

How an attack unfolds

An attacker with local access triggers AMD GPU RAS error paths that leave the ras_manager object null, causing the NBIO handler to dereference it and either panic the kernel or corrupt memory; listed threat actors have targeted similar Linux kernel resource issues in espionage and financially motivated campaigns.

How to fix it

Update to Linux kernel commit 614564a5b28983de53b23a358ebe6c483a2aa21e or later stable releases containing the null check; apply the fix to all affected kernel trees before the CISA-style deadlines referenced in similar kernel issues.

How to confirm the fix worked

Confirm the presence of the null-guard patch in nbio_v7_4.c, rebuild the kernel, boot on AMD hardware, and verify that RAS error injection no longer produces a dereference warning.

Typical attack path

1. Obtain local code execution on a Linux system with vulnerable AMD GPU driver
2. Trigger RAS error condition that initializes nbio_v7_4 without a valid ras_manager object
3. Force the error-printing code path to dereference the null object
4. Observe kernel warning, memory corruption, or system crash

How to detect it

Review kernel logs for warnings originating from nbio_v7_4 RAS error paths; correlate with process activity that exercises GPU RAS features; check for presence of threat-actor TTPs associated with Linux kernel uninitialized-resource or out-of-bounds-write exploits.

What your security team should do

• Prioritize kernel upgrades on all AMD GPU hosts given the memory-corruption family and listed actor interest in Linux kernel flaws
• Monitor EPSS trend (stable at 0.0024) and re-evaluate if new exploit code appears
• Harden local access controls to reduce the attack surface for in-kernel triggers