CVE-2026-23163

What it actually does

Unconditional dereference of uninitialized ih1 ring buffer in amdgpu_gmc_filter_faults_remove leads to NULL pointer dereference and kernel panic when SVM retry fault handling is active on APUs that lack secondary IH rings.

Why it matters to the business

Systems using affected AMD APUs experience unexpected kernel crashes and reboots when the default retry-fault setting is enabled, causing loss of availability and potential data loss for workloads running on those GPUs.

How an attack unfolds

An attacker with local user privileges crafts memory access patterns that trigger SVM page-fault recovery on an affected APU while noretry=0; the recovery path calls amdgpu_gmc_filter_faults_remove which passes an uninitialized ih1 structure to amdgpu_ih_decode_iv_ts_helper, resulting in a kernel NULL dereference crash.

How to fix it

Apply the upstream fix present in commit c74e2dbb5316898fb2113a8ea3a93b27698dbf68 or later; rebuild and boot a kernel containing the added ih1.ring_size guard and restored soft_ih support; alternatively set the noretry=1 module parameter on affected APUs until the kernel is updated.

How to confirm the fix worked

Confirm presence of the ring_size check inside amdgpu_gmc_filter_faults_remove and absence of the crash call trace after applying the patch; verify the running kernel commit or package version matches or supersedes c74e2dbb5316898fb2113a8ea3a93b27698dbf68.

Typical attack path

1. Obtain local shell on target system
2. Ensure noretry=0 is active (default on Renoir after the referenced change)
3. Trigger GPU SVM page faults via userspace GPU or compute workload
4. Force invocation of svm_range_restore_pages and subsequent fault filtering
5. Trigger kernel panic via NULL pointer access

How to detect it

Search kernel logs and dmesg for the exact BUG line 'kernel NULL pointer dereference' together with the call trace containing amdgpu_ih_decode_iv_ts_helper, amdgpu_gmc_filter_faults_remove, svm_range_restore_pages, and gmc_v9_0_process_interrupt.

• BUG: kernel NULL pointer dereference, address: 0000000000000004
• RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]
• amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]
• svm_range_restore_pages+0xae5/0x11c0 [amdgpu]
• gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]

What your security team should do

• Patch to a kernel containing commit c74e2dbb5316898fb2113a8ea3a93b27698dbf68 within the next maintenance window
• Temporarily apply noretry=1 on Raven/Renoir systems if immediate reboot is not feasible
• Add kernel oops monitoring for the specific amdgpu_ih_decode_iv_ts_helper signature
• Review GPU driver deployment pipelines to ensure future stable kernels are adopted promptly