LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43909: drm/amdgpu/pm: Fix the null pointer dereference for smu7

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference for smu7 optimize the code to avoid pass a null pointer (hwmgr->backend) to function smu7_update_edc_leakage_table.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-43909 is a Linux kernel AMDGPU power-management bug. The kernel fix prevents a null pointer from being passed in SMU7 code. The public sources do not provide CVSS, confirmed exploitation, or detailed impact, so treat this mainly as a kernel stability and availability concern.

Executive priority

Handle through normal kernel patch management, with priority for Linux GPU workstations, rendering nodes, or servers where GPU availability matters. There is no sourced evidence of active exploitation, but kernel-level null dereferences can still disrupt operations.

Technical view

The vulnerability is in drm/amdgpu/pm for SMU7. The resolved issue avoids passing a null hwmgr->backend pointer to smu7_update_edc_leakage_table. Public data identifies affected Linux kernel versions and stable fix commits, but does not provide a CWE, CVSS vector, or exploitation details.

Likely exposure

Exposure is most relevant to Linux systems using the AMDGPU driver path involving SMU7 power management. General Linux hosts without that driver or hardware path are less likely to be exposed, but source data does not give a precise hardware matrix.

Exploitation context

The CVE is not listed as KEV in the provided bundle. The cited sources do not claim active exploitation, public exploit availability, or remote attack characteristics. Evidence is incomplete on practical exploitability.

Researcher notes

Do not infer remote exploitability from the CVE text. Focus analysis on the SMU7 AMDGPU power-management path and the stable commits. Public metadata is sparse: no CVSS, CWE, exploit claim, or detailed affected hardware list is supplied.

Mitigation direction

  • Apply Linux kernel updates containing the referenced stable fix commits.
  • Follow distribution guidance, including Debian LTS where applicable.
  • Prioritize Linux systems with AMD GPUs using the amdgpu driver.
  • Track vendor advisories because no standalone workaround is named.
  • Ensure patched systems reboot into the updated kernel.

Validation and detection

  • Inventory Linux kernel versions across AMD GPU systems.
  • Check whether the amdgpu driver is used on affected hosts.
  • Confirm vendor kernel changelogs mention CVE-2024-43909 or referenced commits.
  • Verify systems are running the updated kernel after reboot.
  • Document exceptions where vendor guidance is unavailable.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43909 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
7Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux599a7e9fe1b683d04f889d68f866f5548b1e0239, 599a7e9fe1b683d04f889d68f866f5548b1e0239, 599a7e9fe1b683d04f889d68f866f5548b1e0239, 599a7e9fe1b683d04f889d68f866f5548b1e0239, 599a7e9fe1b683d04f889d68f866f5548b1e0239unaffected
LinuxLinux4.9, 0, 5.15.165, 6.1.105, 6.6.46, 6.10.5, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.