---
id: CVE-2026-43369
title: 'drm/amd: Fix NULL pointer dereference in device cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amd: Fix NULL pointer dereference in device cleanup

  When GPU initialization fails due to an unsupported HW block
  IP blocks may have a NULL version pointer. During …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fc58ef30e0a1524ce72a8e873d773ba3b0830c7d <
    43025c941aced9a9009f9ff20eea4eb78c61deb8
  - >-
    Linux >= 6d7ac4a0ebb6b7bc885274aa8b2bd9971f07013c <
    767cd24d3c4ae847688877def4891943f6611ecd
  - >-
    Linux >= 39fc2bc4da0082c226cbee331f0a5d44db3997da <
    062ea905fff7756b2e87143ffccaece5cdb44267
  - Linux >= 6.18.16 < 6.18.19
  - Linux >= 6.19.6 < 6.19.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:36:38.705069Z'
published: '2026-05-08'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:50.871Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43369'
references:
  - url: 'https://git.kernel.org/stable/c/43025c941aced9a9009f9ff20eea4eb78c61deb8'
  - url: 'https://git.kernel.org/stable/c/767cd24d3c4ae847688877def4891943f6611ecd'
  - url: 'https://git.kernel.org/stable/c/062ea905fff7756b2e87143ffccaece5cdb44267'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01905
ingestedAt: '2026-11-06T15:54:03.930Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd: Fix NULL pointer dereference in device cleanup

When GPU initialization fails due to an unsupported HW block
IP blocks may have a NULL version pointer. During cleanup in
amdgpu_device_fini_hw, the code calls amdgpu_device_set_pg_state and
amdgpu_device_set_cg_state which iterate over all IP blocks and access
adev->ip_blocks[i].version without NULL checks, leading to a kernel
NULL pointer dereference.

Add NULL checks for adev->ip_blocks[i].version in both
amdgpu_device_set_cg_state and amdgpu_device_set_pg_state to prevent
dereferencing NULL pointers during GPU teardown when initialization has
failed.

(cherry picked from commit b7ac77468cda92eecae560b05f62f997a12fe2f2)

## Affected

- `Linux >= fc58ef30e0a1524ce72a8e873d773ba3b0830c7d < 43025c941aced9a9009f9ff20eea4eb78c61deb8`
- `Linux >= 6d7ac4a0ebb6b7bc885274aa8b2bd9971f07013c < 767cd24d3c4ae847688877def4891943f6611ecd`
- `Linux >= 39fc2bc4da0082c226cbee331f0a5d44db3997da < 062ea905fff7756b2e87143ffccaece5cdb44267`
- `Linux >= 6.18.16 < 6.18.19`
- `Linux >= 6.19.6 < 6.19.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.