Security readout for executives and security teams
Plain-English summary
CVE-2024-26657 is a Linux kernel AMDGPU/DRM scheduler bug that can crash the kernel through a null pointer dereference. The source describes a failure path when an AMDGPU wait operation is made without a prior submitted job. Business impact is most likely local denial of service on affected GPU-enabled Linux systems.
Executive priority
Patch through normal kernel maintenance, accelerating for shared or multi-user AMDGPU systems. There is no cited active exploitation or CVSS score, but a kernel crash can disrupt developer workstations, GPU services, and shared compute nodes.
Technical view
The issue is in drm_sched_entity_init reached through amdgpu_ctx_get_entity and amdgpu_cs_wait_ioctl. A prior logic change allowed sched_rq to be NULL when no job exists, leading to a kernel NULL pointer dereference. Stable kernel commits are referenced as fixes, but the source does not provide CVSS or CWE data.
Likely exposure
Likely exposed systems are Linux hosts using AMDGPU DRM on affected kernel versions or downstream kernels carrying the vulnerable scheduler logic. The bundle lists Linux kernel 6.7-era versions and later stable fixes, but exact distribution exposure must be confirmed against vendor kernel packages.
Exploitation context
The bundle says the bug can be triggered through the AMDGPU DRM driver with a valid context. It includes no evidence of active exploitation, and KEV status is false. Treat this as a local crash risk unless vendor advisories identify broader impact.
Researcher notes
Evidence supports a NULL pointer dereference in the AMDGPU wait path when no prior job exists. The available sources identify upstream stable commits but do not provide a complete exploitability assessment, CVSS vector, or distribution-specific affected package list.
Mitigation direction
- Update to a vendor kernel containing the referenced stable fixes.
- Prioritize shared GPU workstations, multi-user Linux hosts, and GPU CI runners.
- Check Linux distribution advisories for backported fixes and affected package names.
- Limit untrusted local access to AMDGPU DRM devices where operationally feasible.
Validation and detection
- Inventory Linux systems with AMD GPUs and DRM enabled.
- Map running kernel versions to vendor advisories or stable fix commits.
- Confirm updated kernels include one of the referenced upstream fixes.
- Review crash logs for drm_sched_entity_init or amdgpu_cs_wait_ioctl null dereferences.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26657 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/74cd204c7afe498aa9dcc3ebf0ecac53d477a429CVE reference, Linux
- https://git.kernel.org/stable/c/54b5b7275dfdec35812ccce70930cd7c4ee612b2CVE reference, Linux
- https://git.kernel.org/stable/c/f34e8bb7d6c6626933fe993e03ed59ae85e16abbCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.