Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Linux kernel AMDGPU driver may crash on bad firmware

CVE-2024-26649 · published 2 years ago
Summary

The AMDGPU graphics driver in the Linux kernel can try to use a piece of firmware that is malformed, causing the system to hit a null‑pointer error and potentially stop working. This issue is fixed in newer kernel releases, so updating your Linux kernel to the latest version will prevent the crash.

What to do
  • Update debian linux to version 6.6.15-1.
  • Update linux kernel to version 6.7.3.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian linux < 6.6.15-1
Fix: upgrade to 6.6.15-1
Debian:14 debian linux < 6.6.15-1
Fix: upgrade to 6.6.15-1
– linux linux_kernel >= 6.3, < 6.6.15
>= 6.7, < 6.7.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Linux linux kernel >= 6.7.0, < 6.7.3
Fix: upgrade to 6.7.3
Original advisory text
drm/amdgpu: Fix the null pointer when load rlc firmware
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_request. There will be a null pointer error in subsequent use. So skip validation to fix it.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-476NULL Pointer Dereference
Timeline
Published26 Mar 2024
Updated4 Nov 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2024-26649 · OSV
CVE-2024-26649 · NVD
CVE-2024-26649 · OSV
Track software like this
Free during beta