CVE-2026-43337

What it actually does

This is a local denial-of-service flaw in the Linux kernel AMD display driver. In the DCN 4.01 display initialization path, dcn401_init_hw() can call the update_bw_bounding_box callback when that function pointer is NULL if the frequency-change condition is true. That NULL pointer dereference occurs in kernel context and can trigger a kernel oops, display subsystem failure, or full system crash depending on kernel configuration and recovery behavior. The issue affects availability only; it does not directly provide confidentiality or integrity impact and does not, by itself, enable remote code execution or privilege escalation.

Why it matters to the business

Systems using affected Linux kernels with AMD display hardware may experience unexpected crashes or graphical/display subsystem failures caused by a local user or workload that can trigger the vulnerable display initialization path. The most likely operational impact is interruption of desktops, workstations, GPU-enabled endpoints, kiosks, or Linux systems that rely on AMD graphics. Server exposure is generally lower unless AMD display components are present and reachable through local user sessions or graphics stack operations. The CVSS score is moderate, EPSS is very low, it is not in CISA KEV, and no public exploit maturity is reported, so remediation should be handled through normal kernel patch cycles unless affected systems provide multi-user local access or perform critical graphical workloads.

How an attack unfolds

An attacker must already have local access to the affected Linux system. They attempt to trigger a display hardware initialization or reinitialization path involving the AMD DCN 4.01 display code, such as through graphics stack activity, display mode changes, suspend/resume, driver reload behavior, or other operations that cause dcn401_init_hw() to execute while the frequency-change condition is true. In the vulnerable code path, the kernel may attempt to call dc->res_pool->funcs->update_bw_bounding_box even when that callback is NULL. Because the call occurs in kernel context, dereferencing the NULL function pointer causes a kernel fault. The practical attacker objective is to crash the system or disrupt the graphical session, producing a denial of service rather than code execution.

How to fix it

Update to a Linux kernel version that includes the upstream fix for the AMD display driver issue. The fix separates the update condition from pointer validation and verifies update_bw_bounding_box, dc->clk_mgr, and bw_params before use. No exact distribution package versions were provided, so use vendor advisories for the relevant Linux distribution, appliance, or kernel source tree and install the first kernel release that includes the fix corresponding to upstream commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477 or its backport. If immediate patching is not possible, reduce risk by limiting local shell/desktop access to trusted users, avoiding unnecessary AMD display driver exposure on systems that do not need it, and scheduling reboots or maintenance windows carefully because kernel updates require booting into the patched kernel. For systems where the AMD display stack is not required, consider using a supported alternative graphics configuration or disabling unnecessary graphical sessions, subject to operational testing.

How to confirm the fix worked

Confirm exposure by identifying systems running Linux kernels that include the affected AMD display code and use AMD display hardware or load AMD display modules such as amdgpu. Validate remediation by confirming the running kernel version is the vendor-fixed version, not merely that an updated package is installed. On source-based or custom kernels, verify the dcn401_init_hw() implementation validates the update_bw_bounding_box callback, dc->clk_mgr, and bw_params before invocation. Operationally, review boot and kernel logs after patching for absence of NULL pointer dereference/oops messages in the AMD display path, and test normal display operations such as login, mode changes, suspend/resume, monitor hotplug, and graphics-session restart where applicable.

Typical attack path

1. Gain local access to a Linux system running an affected kernel with the AMD display driver and relevant AMD display hardware path present.
2. Trigger graphics/display reinitialization behavior, such as changing display state, causing a suspend/resume cycle, restarting the graphics session, or otherwise exercising the AMD DCN 4.01 initialization path.
3. Cause dcn401_init_hw() to enter the bandwidth bounding-box update path where the frequency-changed condition is true.
4. Exploit the missing NULL callback validation so the kernel attempts to call a NULL update_bw_bounding_box function pointer.
5. Induce a kernel oops, display subsystem failure, session termination, or full system crash, resulting in denial of service.

How to detect it

To determine whether this issue was already triggered, review kernel and system logs for crashes or oops events involving the AMD display driver, especially around display initialization, display mode changes, monitor hotplug events, suspend/resume, graphics-session restarts, or user-reported black screens and reboots. Useful sources include journalctl kernel logs, dmesg, /var/log/kern.log, /var/log/messages, /var/log/syslog, crash dumps collected by kdump, systemd-coredump metadata, GPU/display service logs, and endpoint telemetry showing local users initiating display or power-state changes shortly before a crash. Look for NULL pointer dereference traces that include dcn401_init_hw, dcn401_hwseq.c, update_bw_bounding_box, amdgpu, drm/amd/display, or DCN/DC display initialization functions. Because exploitation is local and produces denial of service, there may be no network IOC; evidence is most likely a kernel crash trace correlated with local session activity.

• BUG: kernel NULL pointer dereference
• NULL pointer dereference
• dcn401_init_hw
• dcn401_hwseq.c
• update_bw_bounding_box
• drm/amd/display
• amdgpu
• DCN401
• dc->res_pool->funcs->update_bw_bounding_box
• kernel oops
• Oops:
• RIP: dcn401_init_hw
• Call Trace:
• GPU reset
• amdgpu: GPU reset
• amdgpu: ring
• amdgpu_device_gpu_recover

What your security team should do

• Inventory Linux systems with AMD graphics/display hardware or loaded amdgpu-related kernel modules and prioritize those with local multi-user access, shared workstations, kiosks, VDI endpoints, or critical graphical workloads.
• Track Linux distribution and kernel vendor advisories for CVE-2026-43337 and deploy the fixed kernel through the normal patch process.
• After installing the update, reboot systems and verify they are running the patched kernel version.
• Temporarily restrict untrusted local access on exposed systems until patching is complete, especially where local users can interact with display settings, graphics sessions, or suspend/resume behavior.
• Monitor kernel logs for AMD display NULL pointer dereference, kernel oops, GPU/display reset, or unexplained crash patterns that could indicate attempted exploitation or accidental triggering.
• For custom kernels, cherry-pick or verify inclusion of the upstream fix associated with commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477.
• Treat this as an availability risk rather than a data-theft risk; prioritize based on service criticality and exposure to untrusted local users.