CVE-2026-31765: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31765 is a NULL pointer dereference vulnerability in the Linux kernel's AMDGPU DRM driver caused by a memory size mismatch on systems with 64K page sizes. The constant AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while KFD_CWSR_TBA_TMA_SIZE expands to 128KB on 64K page-size systems (e.g., IBM POWER10 running pSeries Linux), creating an insufficient reserved virtual address space that triggers a kernel crash. Affected kernel versions include 6.9 through 6.12.80, 6.13 through 6.18.21, 6.19 through 6.19.11, and 7.0-rc1 through 7.0-rc6. It was published on May 1, 2026, with patches available by May 11, 2026. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an incorrect buffer size calculation (CWE-131) in the AMDGPU driver, which leads to a NULL pointer dereference (CWE-476). On 4K page-size systems, AMDGPU_VA_RESERVED_TRAP_SIZE (8KB) and KFD_CWSR_TBA_TMA_SIZE (2 × PAGE_SIZE = 8KB) are equal, so GPU memory allocation for the CWSR trap area succeeds. On 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB while the reserved area remains 8KB; when a process calls kfd_ioctl_acquire_vm → kfd_process_device_init_cwsr_dgpu → kfd_process_alloc_gpuvm, the allocation exceeds the reserved space, resulting in a kernel NULL pointer dereference at __mutex_add_waiter. The attack vector is local, requiring low privileges — any user who can invoke AMDGPU-dependent applications (e.g., rocminfo, RCCL unit tests) can trigger the crash (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (NULL pointer dereference, signal 11), resulting in a complete system crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability is scoped to systems running the Linux kernel with AMDGPU support on 64K page-size architectures (e.g., IBM POWER10 pSeries), and any local user with access to GPU-dependent applications can trigger it, making shared compute environments (HPC, ML workloads) particularly at risk (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (3rd percentile), indicating a very low probability of exploitation in the near term. Exploitation requires local access and the ability to run AMDGPU-dependent applications on a 64K page-size system, which significantly limits the attack surface (GitHub Advisory).

1. Identify a vulnerable target: Locate a Linux system running kernel versions 6.9–6.12.80, 6.13–6.18.21, 6.19–6.19.11, or 7.0-rc1 through 7.0-rc6 with an AMD GPU and a 64K page size (e.g., IBM POWER10 pSeries with PAGE_SIZE=64K).
2. Obtain local user access: Gain a shell as any low-privileged local user (uid ≥ 1000) on the target system.
3. Trigger GPU initialization: Execute an AMDGPU-dependent application such as rocminfo or an RCCL unit test, which internally calls kfd_ioctl_acquire_vm via the /dev/kfd ioctl interface.
4. Trigger the crash: The kernel attempts to allocate GPU memory for the CWSR trap area via kfd_process_device_init_cwsr_dgpu; because the allocation size (128KB) exceeds the reserved space (8KB), a NULL pointer dereference occurs in __mutex_add_waiter, causing an immediate kernel panic and system reboot (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing BUG: Kernel NULL pointer dereference on read at 0x00000002; Oops: Kernel access of bad area, sig: 11; call trace referencing __mutex_add_waiter, amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu, kfd_process_device_init_cwsr_dgpu, kfd_ioctl_acquire_vm, and kfd_ioctl in the amdgpu module.
• Process: Unexpected termination of rocminfo, RCCL test binaries, or other ROCm applications immediately followed by a system panic or reboot.
• System: Unexpected system reboots or kernel panics on POWER10 (pSeries) or other 64K page-size systems with AMD GPUs, particularly when GPU workloads are initiated by non-root users (GitHub Advisory).

Apply the upstream kernel patches that change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB and align KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size, ensuring the allocation never exceeds the reserved area. Fixed versions are Linux kernel 6.12.81, 6.18.22, and 6.19.12; patches are available at the stable kernel git repository. As a temporary workaround on unpatched systems, avoid running AMDGPU-dependent applications (e.g., rocminfo, RCCL tests) on 64K page-size systems until the kernel is updated (GitHub Advisory, Red Hat Bugzilla).