CVE-2026-23163: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23163 is a NULL pointer dereference vulnerability in the Linux kernel's drm/amdgpu driver, specifically in the amdgpu_gmc_filter_faults_remove() function. It affects APU platforms such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0) where the ih1 and ih2 interrupt ring buffers are not initialized by design, yet the function unconditionally accesses ih1 to retrieve interrupt timestamps. Affected kernel versions include 6.4 through 6.6.123, 6.7 through 6.12.69, 6.13 through 6.18.9, and 6.19-rc1 through rc7. The vulnerability was published on February 14, 2026, with patches released on March 18, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a NULL pointer dereference (CWE-476) in amdgpu_gmc_filter_faults_remove(), which unconditionally uses the ih1 interrupt ring buffer to call amdgpu_ih_decode_iv_ts_helper(). On APUs, ih1 and ih2 are never initialized — vega10_ih_sw_init() explicitly skips their initialization when AMD_IS_APU is set — leaving the pointer NULL. The vulnerability is triggered via the SVM page fault recovery path (svm_range_restore_pages → amdgpu_vm_handle_fault → gmc_v9_0_process_interrupt → amdgpu_ih_process) when retry faults are enabled (noretry=0). The issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW IP 9.3.0 from noretry=1"), which changed the default for Renoir APUs from noretry=1 to noretry=0, activating the vulnerable code path (Feedly).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. The crash manifests at address 0x0000000000000004 in amdgpu_ih_decode_iv_ts_helper+0x22/0x40, making the affected system unavailable. There is no confidentiality or integrity impact; the vulnerability is limited to availability on systems running affected Linux kernels with AMD APU hardware (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-23163. The vulnerability requires local access with low privileges to trigger, limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000004 with a call trace involving amdgpu_ih_decode_iv_ts_helper, amdgpu_gmc_filter_faults_remove, svm_range_restore_pages, amdgpu_vm_handle_fault, gmc_v9_0_process_interrupt, amdgpu_irq_dispatch, and amdgpu_ih_process.
• System Behavior: Unexpected system crashes or kernel panics on systems with AMD APU hardware (Raven/Renoir GC 9.x) running affected kernel versions with noretry=0 set for the amdgpu driver.

Patches have been released for the following kernel stable branches: versions prior to 6.6.123 (branch 6.4+), prior to 6.12.69 (branch 6.7+), and prior to 6.18.9 (branch 6.13+). Four upstream patch commits are available: 7611d7faccc1, 8b1ecc9377bc, ac251d17d8af, and c74e2dbb5316 (Kernel Patches). As a temporary workaround, setting noretry=1 for the amdgpu module on affected APU systems (Raven/Renoir) will prevent the vulnerable code path from being triggered. Oracle Linux and Ubuntu have also issued updated kernel packages addressing this vulnerability (Oracle Advisory, Ubuntu Advisory).