LiveActive security incident?Get immediate response
CVE Record

CVE-2026-46220: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions that verify fence writeback addresses are dword-aligned. These assertions can be reached from unprivileged userspace via crafted DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a scheduler worker thread. Replace both BUG_ON() calls with WARN_ON() to log the condition without crashing the kernel. A misaligned fence address at this point indicates a driver bug, but crashing the kernel is never the correct response when the assertion is reachable from userspace. The CS IOCTL path is the correct place to filter invalid submissions; the ring emission callback is too late to do anything about it. (cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel denial-of-service issue in the AMDGPU driver. A local unprivileged user can submit malformed GPU work that reaches a fatal kernel assertion and panics the machine. The upstream fix changes the crash behavior to a warning, so the system logs the problem instead of going down.

Executive priority

Treat this as a practical availability risk for AMDGPU Linux environments, especially shared or multi-tenant systems. It is not currently supported by sources as actively exploited, but a local crash primitive can still disrupt production workloads.

Technical view

sdma_v4_0_ring_emit_fence() used BUG_ON checks for dword-aligned fence writeback addresses. The CVE states crafted DRM_IOCTL_AMDGPU_CS submissions can reach those assertions from unprivileged userspace, causing a fatal kernel panic in a scheduler worker thread. Stable kernel commits replace BUG_ON with WARN_ON.

Likely exposure

Exposure is most likely on Linux systems running affected kernels with AMDGPU SDMA4 support where unprivileged local users or workloads can submit AMDGPU command streams. Shared workstations, GPU compute hosts, and multi-user Linux servers should be prioritized.

Exploitation context

The source bundle does not indicate active exploitation, and KEV is false. The described attack context is local userspace access to AMDGPU command submission. The impact described is system availability loss through kernel panic, not data theft or remote code execution.

Researcher notes

The fix intentionally avoids panicking in the late ring emission path. The description notes CS IOCTL validation is the correct filtering point, but the cited resolution only replaces BUG_ON with WARN_ON. No CVSS, CWE, or exploit details are provided.

Mitigation direction

  • Apply Linux kernel or distribution updates that include the referenced stable fixes.
  • Prioritize systems with AMDGPU hardware and untrusted local users or workloads.
  • Review vendor distribution advisories for backported kernel package status.
  • Restrict untrusted access to AMDGPU command submission where operationally practical.
  • Monitor kernel logs for WARN_ON reports after patching.

Validation and detection

  • Inventory Linux kernels on systems using AMDGPU hardware.
  • Confirm whether installed kernels include the stable fix commits or vendor backports.
  • Identify hosts where unprivileged users or workloads can access AMDGPU command submission.
  • Check whether affected hosts are multi-user, shared, or externally managed workloads.
  • Review kernel logs for amdgpu SDMA fence alignment warnings after remediation.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-46220 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7, 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7unaffected
LinuxLinux4.12, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.90, 6.18.32, 7.0.9, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.