CVE-2026-43598: CWE-822 Untrusted Pointer Dereference in AMD AMD Instinct™ MI210

This vulnerability (CVE-2026-43598) is due to improper input validation in the AMD ROCm Communication Collectives Library (RCCL) component of AMD Instinct™ MI210. An attacker who controls a peer rank or is adjacent on the network could exploit this flaw to dereference a pointer controlled by the attacker, which may lead to remote code execution. The CVSS 4.0 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information provided at this time.

Successful exploitation could allow an attacker with limited privileges and network adjacency to execute arbitrary code remotely on the affected system. This could compromise system confidentiality, integrity, and availability. However, exploitation requires a high level of complexity and specific conditions such as control over a peer rank or network adjacency.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is currently available. Monitor AMD's advisories for updates and apply patches once released.