CVE-2024-46896

What it actually does

Kernel crash triggered when a command submission fails validation after num_ibs increment, causing amdgpu_ib_free to dereference an invalid ring pointer overwritten by drm_sched_job_init memset.

Why it matters to the business

Unexpected system reboots or hangs on Linux systems using AMD GPUs, disrupting workloads that rely on graphics or compute acceleration; low exploitability reduces immediate risk but still requires patching for stability.

How an attack unfolds

An attacker with local access crafts a userspace command stream that passes initial checks but fails later validation; this path hits the buggy amdgpu_job_alloc and subsequent ib_free call, dereferencing uninitialized sched data and crashing the kernel.

How to fix it

Upgrade the Linux kernel to a fixed version such as 6.1.122 or apply the stable commit 65501a4fd84ecdc0af863dbb37759242aab9f2dd; rebuild and reboot with the patched kernel; for Ubuntu LTS systems apply the corresponding libxrandr or kernel package updates listed for each release.

How to confirm the fix worked

Confirm the running kernel contains commit 2ae520cb12831d264ceb97c61f72c59d33c0dbd7 or equivalent; attempt to reproduce a failing command submission workload and verify no crash occurs; check dmesg for absence of amdgpu sched-related oops after upgrade.

Typical attack path

1. Obtain local user privileges on an affected Linux system with AMD GPU
2. Trigger a graphics or compute workload that submits a command stream
3. Cause the stream to fail validation after num_ibs has been incremented
4. Force execution of amdgpu_ib_free with a corrupted ring pointer
5. Trigger kernel panic or oops from invalid memory access

How to detect it

Review kernel logs for amdgpu oops or panic messages referencing drm_sched_job_init or invalid sched access; correlate with userspace processes performing graphics submissions around the time of the crash; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all AMD GPU hosts within standard patch windows given low EPSS and absence from KEV
• Test the fix in staging environments using workloads that exercise amdgpu command submission
• Monitor upstream stable kernel releases for additional backports of the drm_sched and amdgpu changes