UBUNTU-CVE-2026-68105: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix kernel panic during driver load failure Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES. BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:gfxv121waitregmem+0x5a/0x1f0 [amdgpu] Call Trace: gfxv121ringemitregwriteregwait+0x1f/0x30 [amdgpu] amdgpugmcfwregwriteregwait+0xb2/0x190 [amdgpu] amdgpugmcflushgputlb+0x1cc/0x230 [amdgpu] amdgpugartinvalidatetlb+0x81/0xa0 [amdgpu] amdgpugartunbind+0x72/0x90 [amdgpu] amdgputtmbackendunbind+0xa4/0xb0 [amdgpu] amdgputtmttunpopulate+0x13/0xd0 [amdgpu] amdttmttunpopulate+0x29/0x70 [amdttm] ttmboput+0x1eb/0x360 [amdttm] amdgpubofreekernel+0xf9/0x1f0 [amdgpu] amdgpuihringfini+0x5a/0x90 [amdgpu] amdgpuirqfinihw+0x58/0x80 [amdgpu] amdgpudevicefinihw+0x4e0/0x5b0 [amdgpu] amdgpudriverloadkms+0x60/0xa0 [amdgpu] amdgpupciprobe+0x28e/0x6d0 [amdgpu] pcideviceprobe+0x19f/0x220 reallyprobe+0x1ed/0x340 driverprobedevice+0x1e/0x80 driverattach+0xd3/0x1a0 busforeachdev+0x68/0xa0 busadddriver+0x19f/0x270 driverregister+0x5d/0xf0 dooneinitcall+0xac/0x200 doinitmodule+0x1ec/0x280 sesysfinitmodule+0x2de/0x310 dosyscall64+0x6a/0x250 entrySYSCALL64afterhwframe+0x4b/0x53 (cherry picked from commit 4623b958dd6da0f4c3026afdf330626a09ecb0f0)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
Linux kernel drm/amdgputo a version that resolves this vulnerability.Patch 4623b958dd6da0f4c3026afdf330626a09ecb0f0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the amdgpu driver on ASICs that use the MES firmware path are exposed when driver loading encounters an MES initialization failure. The listed affected Ubuntu kernel package families include linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants.
What condition triggers the kernel panic?
The panic occurs during amdgpu driver-load failure handling when MES initialization fails but the KIQ ring is incorrectly treated as ready. Subsequent cleanup can dereference a null pointer while performing GPU TLB-related operations.
How can I tell whether a system has encountered this issue?
Look for a kernel NULL pointer dereference during amdgpu probing or driver load, with gfx_v12_1_wait_reg_mem in the trace. Related stack frames may include amdgpu_gmc_flush_gpu_tlb, amdgpu_device_fini_hw, amdgpu_driver_load_kms, and amdgpu_pci_probe.