Cloudanix VulnDB

CVE-2026-98178

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in AMD graphics driver code can crash the whole computer when certain graphics hardware fails to start up properly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in amdgpu KFD node array handling when initialization fails after probe but before node allocation, triggered on subsequent GPU reset.

Why it matters to the business

Kernel panics and system instability on affected AMD GPU hardware, leading to unplanned downtime and potential data loss during graphics or compute workloads.

How an attack unfolds

An attacker with local access triggers a partial KFD initialization failure on unsupported Polaris hardware, followed by a GPU reset that dereferences an unpopulated node array entry.

How to fix it

Update to a Linux kernel containing the referenced commit that gates node array access on the KFD initialization flag; apply vendor backports for supported distributions.

How to confirm the fix worked

Confirm the authoritative KFD initialization flag check exists before node array walks in amdgpu_amdkfd paths; test GPU reset sequences on Polaris hardware that lacks PCIe atomics.

Typical attack path

  1. Obtain local code execution on a system with an affected AMD GPU
  2. Force conditions that cause kgd2kfd_device_init to return early without allocating nodes
  3. Trigger a GPU reset via driver unload/reload or hardware event
  4. Cause kernel panic through invalid memory access in the reset path

How to detect it

Review kernel logs for amdgpu KFD initialization failures followed immediately by node array dereference oops or panic messages on AMD hardware.

What your security team should do

  • Prioritize kernel updates on systems with AMD GPUs within standard patch windows given low EPSS and absence from KEV
  • Monitor vendor kernel advisories for the specific amdgpu fix commit
  • Restrict unprivileged GPU reset capabilities where feasible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpu_amdkfd_clear_kfd_mapping() assumes that a non-NULL kfd_dev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example, kgd2kfd_device_init() sets num_nodes before checking PCIe atomics support. On Polaris systems without the required atomics, it returns before allocating nodes[0], but the kfd_dev remains attached to the amdgpu device. A later GPU reset then dereferences nodes[0]->id. Require the authoritative KFD initialization flag before walking the node array, matching the existing KFD reset and teardown paths. (cherry picked from commit 4ac1835823c47903fbb278bbf474773c46f59edc)

Affected packages

Ecosystem Package Introduced Fixed