CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4)

Q: What level of access does an attacker need?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

Q: What is the practical impact if the flaw is triggered?

The null pointer dereference can cause a kernel oops, resulting in a high availability impact. The supplied CVSS vector indicates no confidentiality or integrity impact.

Q: Under what condition is the affected path reached?

The issue occurs when amdgpu buffer-object size validation requests a memory domain whose TTM domain manager does not exist. An uninitialized GTT domain is specifically identified as a likely bug condition.

Published Oct 7, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix size validation for non-exclusive domains (v4)

Fix amdgpubovalidatesize() to check whether the TTM domain manager for the requested memory exists, else we get a kernel oops when dereferencing "man".

v2: Make the patch standalone, i.e. not dependent on local patches. v3: Preserve old behaviour and just check that the manager pointer is not NULL. v4: Complain if GTT domain requested and it is uninitialized--most likely a bug.

Affected Software

3 affected components

Linux Linux kernel

Linux Linux kernel>=4.2<6.0.19

Linux Linux kernel>=6.1<6.1.5

Event History

Oct 7, 2025

CVE Published

via MITRE·03:19 PM

Data Sourced

via MITRE·03:19 PM

Description

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need?

The CVSS vector indicates local access and low privileges are required. No user interaction is required.

What is the practical impact if the flaw is triggered?

The null pointer dereference can cause a kernel oops, resulting in a high availability impact. The supplied CVSS vector indicates no confidentiality or integrity impact.

Under what condition is the affected path reached?

The issue occurs when amdgpu buffer-object size validation requests a memory domain whose TTM domain manager does not exist. An uninitialized GTT domain is specifically identified as a likely bug condition.

CVE-2022-50527: drm/amdgpu: Fix size validation for non-exclusive domains (v4)

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need?

What is the practical impact if the flaw is triggered?

Under what condition is the affected path reached?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What is the practical impact if the flaw is triggered?

Under what condition is the affected path reached?