CVE-2026-46276 drm/amdgpu: fix zero-size GDS range init on RDNA4
A kernel crash occurs during driver initialization on RDNA4 GPUs if debug memory management is enabled, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46276?
CVE-2026-46276 is a medium-severity vulnerability in Linux kernel, published on 8 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix zero-size GDS range init on RDNA4
RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory resources. The gfx_v12_0 initialisation code correctly leaves adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero to reflect this.
amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for each of these resources regardless of size. When the size is zero, amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(), which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT.
Guard against this by returning 0 early from amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM resource manager registration for hardware resources that are absent, without affecting any other GPU type.
DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in the kernel config. This is apparently rarely enabled as these chips have been in the market for over a year and this issue was only reported now.
Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html (cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
Which versions are affected by CVE-2026-46276?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46276?
Apply the vendor's patch.
Is CVE-2026-46276 being exploited?
There is no known exploitation of CVE-2026-46276 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-89631, BELL-CVE-2026-46276, DEBIAN-CVE-2026-46276, GHSA-qm9f-7whf-hhc4, ROOT-OS-DEBIAN-11-CVE-2026-46276, ROOT-OS-DEBIAN-12-CVE-2026-46276 and 1 more.