CVE-2026-46276: drm/amdgpu: fix zero-size GDS range init on RDNA4
Vulnerability summary
CVE-2026-46276 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 2% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 19 · Related 19Timeline
- 08-06-2026PublishedVulnerability first disclosed.
- 14-06-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory resources. The gfx_v12_0 initialisation code correctly leaves adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero to reflect this. amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for each of these resources regardless of size. When the size is zero, amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(), which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT. Guard against this by returning 0 early from amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM resource manager registration for hardware resources that are absent, without affecting any other GPU type. DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in the kernel config. This is apparently rarely enabled as these chips have been in the market for over a year and this issue was only reported now. Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html (cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.12%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
Decrease -0.04 pp
From 0.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu111 products
- linuxAll versions (No fix recorded) | < 7.0.0-27.27
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 7.0.0-1008.8
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ c832c346cdf9022872655be621880e0f66f4135d, < 1f5d33e7b0a9a2a140f46e22fb52eede323c5946 | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 9bc925759c05feae7dfa9570e77131d54729c8ea | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 36f9602fb22ede69fcc8b422be0cf8105bf655ad | ≥ c832c346cdf9022872655be621880e0f66f4135d, < be0376affcafa0bbb371bb501579a825eae32281 | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 0e21db1a77967bc15df662efdca8ea8a61d124ea | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 30c000a49094ec568c9b51b7421f7a4a3f0b0298 | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 3e26c76891ab99fa173e9c501119fbb5c9f4600f | ≥ c832c346cdf9022872655be621880e0f66f4135d, < 095a8b0ad3c3b5cdc3850d961adb8a8f735220bb | 4.20
- linux_kernel≥ 4.20, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.140 | ≥ 6.7, < 6.12.86 | ≥ 6.13, < 6.18.27 | ≥ 6.19, < 7.0.4 | 7.1:rc1
Debian1 product
- linux< 6.1.176-1 | < 6.12.86-1 | < 7.0.4-1
3 vendors · 114 products
