CVE-2026-46245

What it actually does

This is a Linux kernel denial-of-service flaw in the AMDGPU display driver. During hot-plug-detect initialization, amdgpu_dm_hpd_init() can encounter a DRM connector whose dc_link pointer is NULL. The code accounts for that possibility in one decision path but later dereferences dc_link unconditionally while setting up HPD interrupt handling. If the vulnerable path is reached, the kernel can trigger a NULL pointer dereference, causing an Oops, GPU/display subsystem failure, or full system crash depending on kernel panic settings and platform behavior. The issue requires local access and does not provide confidentiality or integrity impact by itself.

Why it matters to the business

Systems using affected Linux kernels with AMD GPU display functionality may be vulnerable to local disruption. A successful trigger can crash the host or make the graphical/display stack unstable, interrupting workstations, kiosks, GPU-enabled endpoints, and any services that depend on host availability. The current EPSS is very low, it is not listed in CISA KEV, and no exploit maturity is reported, so broad active exploitation is not indicated; however, the operational consequence is high availability loss on exposed systems where untrusted local users or workloads can interact with the graphics stack.

How an attack unfolds

An attacker first needs local access to a system running an affected Linux kernel with the AMDGPU display driver in use. The attacker then attempts to place the display subsystem into a state where a connector object exists without a valid dc_link, such as during graphics initialization, display reconfiguration, or hot-plug-related activity. When amdgpu_dm_hpd_init() processes that connector, the vulnerable code path assigns dc_link but does not skip the connector if the pointer is NULL. It then dereferences dc_link while evaluating HPD interrupt setup. The dereference of a NULL kernel pointer causes a kernel fault, which can result in a kernel Oops, graphics stack failure, or complete system panic/reboot. There is no indication from the provided intelligence that this vulnerability is being used by named threat actors or ransomware campaigns.

How to fix it

Upgrade to a Linux kernel build from the relevant distribution or vendor that includes the upstream AMDGPU display fix for 'drm/amd/display: Fix dc_link NULL handling in HPD init'. No exact fixed package versions were provided, so use vendor advisories, kernel changelogs, or distribution security trackers to identify the first fixed kernel for each supported release stream. Prioritize systems with AMD GPUs, graphical sessions, kiosks, shared workstations, and multi-user Linux environments. If immediate patching is not possible, reduce exposure by limiting local shell access to trusted users, avoiding untrusted workloads on affected graphical hosts, disabling or avoiding AMDGPU display functionality where operationally acceptable, or using temporary kernel boot/module mitigations such as disabling the affected graphics driver only after validating business impact. These mitigations may reduce functionality and should not replace patching.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version is at or above the vendor-fixed build and that the installed kernel changelog includes the AMDGPU display HPD NULL-handling fix. On source-based or custom kernels, validate that amdgpu_dm_hpd_init() assigns dc_link and skips connectors where dc_link is NULL before accessing dc_link->irq_source_hpd. Reboot into the fixed kernel and confirm with uname -a and package manager output that the active kernel is the patched one, not merely installed. Confirm AMDGPU loads normally and display hot-plug or connector enumeration does not produce kernel Oops messages. Review dmesg or journalctl -k after reboot and display testing for absence of NULL pointer dereference traces involving amdgpu_dm_hpd_init or amdgpu_dm_irq.c.

Typical attack path

1. Obtain local, low-privileged access to a Linux system using an affected kernel and AMDGPU display functionality.
2. Identify that the AMDGPU DRM/display driver is loaded and active.
3. Trigger display initialization, connector enumeration, hot-plug, or display reconfiguration behavior that reaches amdgpu_dm_hpd_init().
4. Cause or encounter a connector state where the connector lacks a valid dc_link pointer.
5. The vulnerable kernel code dereferences the NULL dc_link pointer while setting up HPD interrupt handling.
6. The kernel logs a NULL pointer dereference/Oops and the system may experience display failure, panic, reboot, or service interruption.

How to detect it

Detection should focus on evidence of attempted or successful local denial of service, because this flaw does not create a distinctive network indicator and exploitation primarily manifests as kernel faults. Review kernel logs from journalctl -k, dmesg, /var/log/kern.log, /var/log/messages, and crash dump tooling such as kdump, apport, ABRT, or systemd-coredump if enabled. Look for NULL pointer dereference, kernel Oops, panic, or call traces involving amdgpu_dm_hpd_init(), amdgpu_dm_irq.c, amdgpu, drm/amd/display, HPD, or connector initialization immediately before a reboot, display outage, or GPU reset. Correlate timestamps with local logins, new processes run by untrusted users, display reconfiguration commands, hot-plug events, or repeated graphical session failures. Because benign driver bugs can produce similar traces, treat repeated crashes involving the same AMDGPU HPD initialization path, especially near local user activity, as suspicious. There are no known named threat actors, ransomware campaigns, public exploit indicators, or remote network signatures associated with the provided data.

• amdgpu_dm_hpd_init
• amdgpu_dm_irq.c
• NULL pointer dereference
• BUG: kernel NULL pointer dereference
• Oops:
• Kernel panic - not syncing
• Call Trace:
• amdgpu
• drm/amd/display
• irq_source_hpd
• DC_IRQ_SOURCE_INVALID
• HPD
• hotplug
• /var/log/kern.log
• /var/log/messages
• journalctl -k

What your security team should do

• Inventory Linux systems with AMD GPUs or the amdgpu kernel module loaded, prioritizing shared endpoints, workstations, kiosks, and multi-user servers.
• Patch affected systems to a vendor kernel containing the AMDGPU HPD NULL-pointer fix as part of the next maintenance cycle, or sooner for systems exposed to untrusted local users.
• Because this is not in CISA KEV, has very low EPSS, and has no reported exploit maturity, prioritize based on local-user exposure and availability criticality rather than internet exposure.
• Monitor kernel logs for NULL pointer dereference, Oops, panic, or call traces referencing amdgpu_dm_hpd_init, amdgpu_dm_irq.c, or AMDGPU display hot-plug handling.
• Restrict local interactive access and untrusted workloads on affected graphical Linux systems until patching is complete.
• For custom kernels, backport the specific upstream patch that skips connectors with NULL dc_link during HPD initialization and regression-test AMDGPU display behavior.