CVE-2024-49907

What it actually does

Null pointer dereference when dc->clk_mgr is null but passed to dc->hwss.apply_idle_power_optimizations (resolving to dcn35_apply_idle_power_optimizations), allowing kernel memory corruption.

Why it matters to the business

Affected Linux systems with AMD GPUs may experience crashes or instability, causing operational downtime; low EPSS and no KEV status reduce immediate urgency despite listed threat actor interest in similar kernel flaws.

How an attack unfolds

Attacker with local access triggers the display power optimization code path where a prior null check on clk_mgr was not propagated, dereferencing the null pointer; similar Linux kernel issues have been targeted in 2024 espionage and financially motivated campaigns.

How to fix it

Apply kernel updates containing the null check before dc->hwss.apply_idle_power_optimizations call; no specific package versions provided beyond general Linux kernel fixes.

How to confirm the fix worked

Confirm source contains explicit null check on dc->clk_mgr prior to the apply_idle_power_optimizations call and test affected AMD GPU configurations for stability.

Typical attack path

1. Obtain local access to affected Linux system
2. Trigger AMD display idle power optimization code path
3. Force null dc->clk_mgr dereference leading to crash or corruption

How to detect it

Inspect kernel logs and dmesg for references to clk_mgr null dereference or dcn35_apply_idle_power_optimizations crashes; correlate with threat actor patterns targeting Linux kernel resource issues.

• dc->clk_mgr
• dcn35_apply_idle_power_optimizations
• apply_idle_power_optimizations

What your security team should do

• Prioritize kernel updates on AMD GPU hosts
• Monitor Coverity or static analysis reports for similar FORWARD_NULL issues
• Review system stability after applying fixes