UBUNTU-CVE-2026-97947: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write() are exported functions around amdsmnrw(), so they are always available even if amdsmninit() fails. In that case, 'amdroots' is NULL and amdsmnrw() will access uninitialized memory. Then, commit: 83518453074d ("x86/amdnode: Add SMN offsets to exclusive region access") added the 'smnexclusive' flag, which indicated the calls to pcirequestconfigregionexclusive() succeeded, to prevent concurrent userspace access. Commit: 0a4b61d9c2e4 ("x86/amdnode: Fix AMD root device caching") re-ordered initialization so pcirequestconfigregionexclusive() is called earlier and a failure exits amdsmninit() before allocating 'amdroots'. The setting of 'smnexclusive' moved to the end of amdsmninit(), after 'amdroots' is allocated. It became redundant and can be removed. Replace 'smnexclusive' with directly checking 'amdroots', to fix a potential NULL pointer dereference and to simplify the logic. [ bp: Reorg commit message, touchup comment. ] [ mingo: Rebase & further touchups. ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition leads to the unsafe access?
The condition occurs when amd_smn_init() fails before amd_roots is allocated. The exported amd_smn_read() and amd_smn_write() functions can still be called and may access amd_roots while it is NULL.
Is there a documented workaround if an updated kernel cannot be installed immediately?
No workaround or configuration mitigation is provided in the available information.