Loading story…
CVE-2024-41093 is a null-pointer dereference in the Linux kernel's AMDGPU DRM virtual KMS code. A local low-privileged user could trigger a kernel crash and denial of service because the driver accessed state->fb->obj[0] without confirming that the framebuffer object existed. The issue is rated Moderate by Red Hat, with a CVSS v3.1 score of 5.5 and high availability impact.
The upstream fix replaces the direct object access with drm_gem_fb_get_obj() and returns an error when no framebuffer object is present. Corrected upstream kernels include 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10; Red Hat has released updated RHEL 8 and RHEL 9 kernel and kernel-rt packages, while RHEL 6 and 7 are not affected. Organizations using AMDGPU should deploy the relevant kernel updates and reboot affected hosts.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2024:8856 for the RHEL 8 kernel and RHSA-2024:8870 for the RHEL 8 kernel-rt, addressing CVE-2024-41093.
Red Hat released RHSA-2024:6993, fixing CVE-2024-41093 in the Red Hat Enterprise Linux 8.8 Extended Update Support kernel.
Red Hat released RHSA-2024:10771, RHSA-2024:10772, and RHSA-2024:10773, fixing CVE-2024-41093 in RHEL 9.4 EUS kernel and RHEL 9.2 EUS kernel and kernel-rt packages.
Red Hat released RHSA-2024:9315 to fix CVE-2024-41093 in the Red Hat Enterprise Linux 9 kernel.
Fixes for the AMDGPU DRM flaw were included in Linux kernel versions 5.15.162, 6.1.97, 6.6.37, 6.9.8, and 6.10. The Linux kernel CVE team recommended upgrading to the latest stable release rather than cherry-picking an individual patch.
The Linux kernel CVE team assigned CVE-2024-41093 for a NULL framebuffer-object dereference in AMDGPU virtual KMS code. The affected code accessed state->fb->obj[0] directly; the fix obtains the object through drm_gem_fb_get_obj() and returns an error if it is NULL.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-52817** is a moderate-severity flaw in the Linux kernel's AMDGPU DRM driver. On affected GPUs, including VEGA20, a low-privileged local user can read the `amdgpu_regs_smc` debugfs file while the `smc_rreg` pointer is NULL, triggering a NULL-pointer dereference in `amdgpu_debugfs_regs_smc_read` and causing a kernel oops or system crash. Red Hat rates the local denial-of-service issue CVSS 3.1 5.5. The vulnerability is fixed in Linux stable releases 4.19.300, 5.4.262, 5.10.202, 5.15.140, 6.1.64, 6.5.13, 6.6.3, and 6.7 and later. Red Hat issued standard-kernel fixes for RHEL 8 and RHEL 9, plus the RHEL 8 real-time kernel, through advisories including RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:9315; RHEL 9 `kernel-rt` was listed as affected. Administrators should deploy the latest vendor-supported kernel update rather than backporting individual patches.
Aug 26, 2026
**CVE-2023-52470** affects the Linux kernel DRM/Radeon driver because `radeon_crtc_init()` did not validate the result of `alloc_workqueue()` when creating its `flip_queue`. Under an allocation failure, initialization could continue with a NULL workqueue pointer, causing a kernel null-pointer dereference and allowing a local denial of service through a crash, restart, or process exit. Red Hat rates the flaw Low severity (CVSS 3.1: 4.4); confidentiality and integrity are not affected, but availability impact is high. Upstream and stable kernel patches now allocate and validate the workqueue before DRM CRTC initialization, free the Radeon CRTC object if allocation fails, and exit safely. The fix is included in Linux stable releases, including Fedora's 6.6.16 update. Red Hat issued fixes for standard and real-time RHEL 8 kernels and the standard RHEL 9 kernel; RHEL 6 and 7 variants remained under investigation, while the RHEL 9 real-time kernel fix was deferred.
Aug 26, 2026
**CVE-2024-26939** is a use-after-free flaw in the Linux kernel's Intel i915 DRM graphics driver, in `drivers/gpu/drm/i915/i915_vma.c`. A race between i915 VMA destruction and asynchronous retirement can free a VMA while retirement logic still accesses it, allowing a local low-privileged attacker to crash the affected system. The vulnerability was introduced in Linux 5.19 and can produce debug-object warnings when a GPU GT is parked. The issue is fixed upstream in Linux kernel versions 6.1.88, 6.6.29, 6.8.3, and 6.9-rc2 and later stable releases. Red Hat has issued fixes for RHEL 8, RHEL 8 kernel-rt, RHEL 9, and RHEL 9.4 Extended Update Support; RHEL 9 kernel-rt is marked will not fix, while RHEL 6 and 7 variants are outside support scope. Red Hat rates the flaw Moderate at CVSS 5.5, compared with scores of 7.0 from NVD and 7.8 from CVE.org.
Aug 26, 2026