CVE-2026-97947: x86/amd_node: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved:
x86/amdnode: Fix potential NULL pointer dereference
amdsmnread/write() are exported functions around amdsmnrw(), so they are always available even if amdsmninit() fails. In that case, 'amdroots' is NULL and amdsmnrw() will access uninitialized memory.
Then, commit:
83518453074d ("x86/amdnode: Add SMN offsets to exclusive region access")
added the 'smnexclusive' flag, which indicated the calls to pcirequestconfigregionexclusive() succeeded, to prevent concurrent userspace access.
Commit:
0a4b61d9c2e4 ("x86/amdnode: Fix AMD root device caching")
re-ordered initialization so pcirequestconfigregionexclusive() is called earlier and a failure exits amdsmninit() before allocating 'amdroots'. The setting of 'smnexclusive' moved to the end of amdsmninit(), after 'amdroots' is allocated. It became redundant and can be removed.
Replace 'smnexclusive' with directly checking 'amdroots', to fix a potential NULL pointer dereference and to simplify the logic.
[ bp: Reorg commit message, touchup comment. ] [ mingo: Rebase & further touchups. ]
Affected Software
Event History
Frequently Asked Questions
When can the NULL pointer dereference occur?
It can occur when amd_smn_init() fails and leaves amd_roots as NULL, but code subsequently calls the exported amd_smn_read() or amd_smn_write() functions. Those functions remain available even when initialization fails.
Which systems are most relevant to triage?
Systems using the Linux kernel's x86 AMD node and SMN access functionality are relevant. The failure condition specifically involves unsuccessful AMD SMN initialization followed by an SMN read or write operation.
How can I determine whether this condition may have affected a system?
Investigate whether amd_smn_init() failed and whether amd_smn_read() or amd_smn_write() was called afterward. The vulnerable path is characterized by access to SMN functionality while amd_roots has not been allocated.
What does the fix change?
The fix checks amd_roots directly before using it, preventing access when initialization did not allocate the structure. It also removes the redundant smn_exclusive state tracking.