CVE-2026-46276
drm/amdgpu: fix zero-size GDS range init on RDNA4
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory resources. The gfx_v12_0 initialisation code correctly leaves adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero to reflect this. amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for each of these resources regardless of size. When the size is zero, amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(), which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT. Guard against this by returning 0 early from amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM resource manager registration for hardware resources that are absent, without affecting any other GPU type. DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in the kernel config. This is apparently rarely enabled as these chips have been in the market for over a year and this issue was only reported now. Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html (cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
INFO
Published Date :
June 8, 2026, 5:16 p.m.
Last Modified :
July 23, 2026, 7:10 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to include the fix.
- Ensure CONFIG_DRM_DEBUG_MM is not enabled.
- Avoid modprobe of amdgpu on affected hardware.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46276.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46276 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46276
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46276 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-46276 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: drm/amdgpu: corrige la inicialización de rango GDS de tamaño cero en RDNA4 El hardware RDNA4 (GFX 12) elimina los recursos de memoria en chip GDS, GWS y OA. El código de inicialización gfx_v12_0 deja correctamente adev->gds.gds_size, adev->gds.gws_size y adev->gds.oa_size en cero para reflejar esto. amdgpu_ttm_init() llama incondicionalmente a amdgpu_ttm_init_on_chip() para cada uno de estos recursos, independientemente del tamaño. Cuando el tamaño es cero, amdgpu_ttm_init_on_chip() reenvía la llamada a ttm_range_man_init(), que llama a drm_mm_init(mm, 0, 0). drm_mm_init() dispara inmediatamente DRM_MM_BUG_ON(start + size <= start) -- trivialmente cierto cuando el tamaño es cero -- lo que provoca el fallo del kernel durante el modprobe de amdgpu en una RX 9070 XT. Se evita esto devolviendo 0 anticipadamente desde amdgpu_ttm_init_on_chip() cuando size_in_page es cero. Esto omite el registro del gestor de recursos TTM para los recursos de hardware que están ausentes, sin afectar a ningún otro tipo de GPU. DRM_MM_BUG_ON() solo se activa si CONFIG_DRM_DEBUG_MM está habilitado en la configuración del kernel. Esto aparentemente rara vez está habilitado, ya que estos chips han estado en el mercado durante más de un año y este problema solo se informó ahora. Análisis de Oops: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html (seleccionado de la confirmación 5719ce5865279cad4fd5f01011fe037168503f2d) -
Initial Analysis by [email protected]
Jul. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.86 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.27 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.4 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/095a8b0ad3c3b5cdc3850d961adb8a8f735220bb Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0e21db1a77967bc15df662efdca8ea8a61d124ea Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/1f5d33e7b0a9a2a140f46e22fb52eede323c5946 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/30c000a49094ec568c9b51b7421f7a4a3f0b0298 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/36f9602fb22ede69fcc8b422be0cf8105bf655ad Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3e26c76891ab99fa173e9c501119fbb5c9f4600f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9bc925759c05feae7dfa9570e77131d54729c8ea Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/be0376affcafa0bbb371bb501579a825eae32281 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '1f5d33e7b0a9a2a140f46e22fb52eede323c5946', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '9bc925759c05feae7dfa9570e77131d54729c8ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '36f9602fb22ede69fcc8b422be0cf8105bf655ad', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': 'be0376affcafa0bbb371bb501579a825eae32281', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '0e21db1a77967bc15df662efdca8ea8a61d124ea', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '30c000a49094ec568c9b51b7421f7a4a3f0b0298', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '3e26c76891ab99fa173e9c501119fbb5c9f4600f', 'versionType': 'git'}, {'status': 'affected', 'version': 'c832c346cdf9022872655be621880e0f66f4135d', 'lessThan': '095a8b0ad3c3b5cdc3850d961adb8a8f735220bb', 'versionType': 'git'}], 'programFiles': ['drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.20'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.20', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.86', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.27', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.4', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory resources. The gfx_v12_0 initialisation code correctly leaves adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at zero to reflect this. amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for each of these resources regardless of size. When the size is zero, amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(), which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT. Guard against this by returning 0 early from amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM resource manager registration for hardware resources that are absent, without affecting any other GPU type. DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in the kernel config. This is apparently rarely enabled as these chips have been in the market for over a year and this issue was only reported now. Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html (cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d) Added Reference https://git.kernel.org/stable/c/095a8b0ad3c3b5cdc3850d961adb8a8f735220bb Added Reference https://git.kernel.org/stable/c/0e21db1a77967bc15df662efdca8ea8a61d124ea Added Reference https://git.kernel.org/stable/c/1f5d33e7b0a9a2a140f46e22fb52eede323c5946 Added Reference https://git.kernel.org/stable/c/30c000a49094ec568c9b51b7421f7a4a3f0b0298 Added Reference https://git.kernel.org/stable/c/36f9602fb22ede69fcc8b422be0cf8105bf655ad Added Reference https://git.kernel.org/stable/c/3e26c76891ab99fa173e9c501119fbb5c9f4600f Added Reference https://git.kernel.org/stable/c/9bc925759c05feae7dfa9570e77131d54729c8ea Added Reference https://git.kernel.org/stable/c/be0376affcafa0bbb371bb501579a825eae32281