CVE-2026-23163

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove

On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and

ih2 interrupt ring buffers are not initialized. This is by design, as

these secondary IH rings are only available on discrete GPUs. See

vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when

AMD_IS_APU is set.

However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to

get the timestamp of the last interrupt entry. When retry faults are

enabled on APUs (noretry=0), this function is called from the SVM page

fault recovery path, resulting in a NULL pointer dereference when

amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[].

The crash manifests as:

BUG: kernel NULL pointer dereference, address: 0000000000000004

RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]

Call Trace:

amdgpu_gmc_filter_faults_remove+0x60/0x130 [am

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References