CVE-2026-53325

What it actually does

This is a Linux kernel denial-of-service flaw in the AMD64 AGP driver. When the driver probes for AMD northbridge hardware, cache_nbs() may correctly return a negative error such as -ENODEV when the hardware is absent, especially in virtualized environments such as QEMU/KVM. The vulnerable probe path checks only for -1 instead of any negative return value, so initialization continues after a failed hardware discovery. The driver can then call agp_add_bridge(), which reaches amd64_fetch_size(); node_to_amd_nb(0) returns NULL, and dereferencing the missing northbridge structure triggers a NULL pointer dereference / General Protection Fault. The practical technical impact is a local or configuration-triggered kernel crash rather than code execution.

Why it matters to the business

Successful triggering can crash affected Linux systems, causing workload interruption, virtual machine downtime, failed boot or driver initialization events, and operational instability where the AMD64 AGP driver is loaded without the expected hardware. The risk is highest for environments that run kernels with this driver enabled in virtualized or hardware-mismatched configurations. Public exploitation signals are currently low: EPSS is 0.00126, no known exploited-in-the-wild status is reported, it is not in the CISA KEV catalog, and no exploit maturity is identified.

How an attack unfolds

An attacker or misconfigured workload needs a way to cause the vulnerable AMD64 AGP driver probe path to execute on a system where no compatible AMD northbridge exists. In a typical scenario, this occurs when the kernel or module configuration attempts to load/probe the amd64 AGP driver inside a virtualized environment such as QEMU/KVM. The driver calls cache_nbs(), receives a negative error indicating the hardware is absent, but the vulnerable code fails to treat that value as fatal unless it is exactly -1. Initialization continues into AGP bridge setup. Later, amd64_fetch_size() attempts to access the northbridge structure returned by node_to_amd_nb(0), which is NULL, causing a General Protection Fault and kernel crash. There is no indication from the supplied intelligence that this flaw is being used by named threat actors, ransomware campaigns, or public exploit tooling.

How to fix it

Apply the Linux kernel update that includes the corrected agp_amd64_probe() error handling, where any negative return value from cache_nbs() causes the probe to abort. If distribution-specific fixed packages are available, upgrade to the vendor-patched kernel version and reboot into that kernel. Where immediate patching is not possible, reduce exposure by preventing the amd64 AGP driver from loading on systems that do not require it, especially virtual machines. Mitigations may include blacklisting the relevant AGP module, disabling unnecessary AGP support in custom kernels, or removing the driver from initramfs images where operationally safe. Validate mitigation choices carefully on systems that rely on legacy AGP graphics functionality.

How to confirm the fix worked

Confirm the running kernel version contains the upstream or vendor fix for the AMD64 AGP probe error-handling change. Verify systems have rebooted into the patched kernel rather than merely installing updated packages. Check whether the AMD64 AGP driver is loaded using module inspection tools such as lsmod or by reviewing /sys/module entries. On systems where the driver is not needed, confirm module blacklisting or kernel configuration prevents loading at boot and at runtime. Test representative virtualized hosts or guests by ensuring boot and module initialization no longer produce kernel oops, General Protection Fault, or NULL pointer dereference messages associated with amd64_fetch_size(), agp_amd64_probe(), node_to_amd_nb(), or agpgart-amd64.

Typical attack path

1. Identify a Linux system running an affected kernel with the AMD64 AGP driver available or enabled.
2. Ensure the system context lacks a physical AMD northbridge, such as a virtualized QEMU/KVM guest or incompatible hardware environment.
3. Trigger loading or probing of the AMD64 AGP driver, for example through module auto-loading, manual module insertion, or boot-time driver initialization.
4. The driver receives a negative hardware-discovery error from cache_nbs() but does not abort correctly.
5. Driver initialization proceeds into AGP bridge setup and calls amd64_fetch_size().
6. The kernel dereferences a NULL AMD northbridge pointer and raises a General Protection Fault, crashing or destabilizing the system.

How to detect it

Look for evidence of prior kernel crashes or failed driver initialization in kernel logs, persistent journal logs, crash dump systems, and host monitoring. Relevant sources include dmesg output, /var/log/kern.log, /var/log/messages, /var/log/syslog, systemd-journald kernel entries, kdump/vmcore records, netconsole logs, hypervisor console captures, and EDR or observability telemetry that records kernel oops events. Search for General Protection Fault, NULL pointer dereference, kernel oops, or panic messages that include the AMD64 AGP driver path or functions such as amd64_fetch_size(), agp_amd64_probe(), agp_add_bridge(), node_to_amd_nb(), cache_nbs(), agpgart-amd64, or amd64-agp. Also review audit, shell history, automation logs, and configuration management records for unexpected or repeated attempts to load AGP-related kernel modules on virtual machines, such as modprobe activity for amd64_agp, amd64-agp, agpgart-amd64, or agpgart. Because this issue produces a crash rather than a durable compromise artifact, detection should focus on crash timing, module-load events immediately before the crash, and repeated reproducible failures in virtualized environments.

• amd64_fetch_size
• agp_amd64_probe
• agp_add_bridge
• node_to_amd_nb
• cache_nbs
• agpgart-amd64
• amd64_agp
• amd64-agp
• NULL pointer dereference
• general protection fault
• Oops:
• kernel BUG
• BUG: kernel NULL pointer dereference
• modprobe amd64_agp
• modprobe agpgart
• /sys/module/amd64_agp
• /sys/module/agpgart
• /var/crash
• vmcore

What your security team should do

• Prioritize patching Linux kernels on virtualized systems and images where the AMD64 AGP driver may be present, even though known exploitation likelihood is currently low.
• Inventory systems and base images for kernels with AMD64 AGP / agpgart support enabled, with particular attention to QEMU/KVM guests and legacy kernel configurations.
• Disable or blacklist the AMD64 AGP driver on systems that do not require AGP functionality as a short-term mitigation.
• Monitor kernel logs and crash telemetry for General Protection Faults or NULL pointer dereferences involving amd64_fetch_size(), agp_amd64_probe(), node_to_amd_nb(), agp_add_bridge(), or agpgart-amd64.
• Ensure golden images, hypervisor guest templates, and custom kernel builds consume the patched kernel so newly provisioned systems are not reintroduced with the vulnerable behavior.
• Treat any repeatable crash caused by loading agpgart-amd64 in a virtualized environment as potential exploitation or unsafe configuration until patched.