In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer… (CVE-2026-53325)
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.
AI Analysis
Technical Summary
The Linux kernel AMD64 AGP driver contains a flaw in agp_amd64_probe() where error propagation is broken. Specifically, when no AMD northbridge hardware is present (common in virtualized environments like qemu/kvm), cache_nbs() returns -ENODEV, but the probe function only checks for a return value of exactly -1 instead of any negative value. This causes the driver to continue initialization improperly, eventually calling agp_add_bridge() and amd64_fetch_size(), which dereferences a NULL pointer returned by node_to_amd_nb(0). The fix involves correcting the error check to abort on any negative return value from cache_nbs(), preventing the NULL pointer dereference and subsequent crash.
Potential Impact
The vulnerability results in a denial of service via a kernel crash (General Protection Fault) when the AMD64 AGP driver is used in virtualized environments without physical AMD northbridge hardware. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the AMD64 AGP driver in virtualized environments lacking AMD northbridge hardware or apply kernel updates once provided by the vendor that correct the error handling in agp_amd64_probe().
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer… (CVE-2026-53325)
Description
In the Linux kernel, the following vulnerability has been resolved: agp/amd64: Fix broken error propagation in agp_amd64_probe() A NULL pointer dereference was observed in the AMD64 AGP driver when running in a virtualized environment (e.g. qemu/kvm) without a physical AMD northbridge. The crash occurs in amd64_fetch_size() when attempting to dereference the pointer returned by node_to_amd_nb(0). The root cause of this crash is broken error propagation in agp_amd64_probe(): When no AMD northbridges are found, cache_nbs() correctly returns -ENODEV. However, the probe function erroneously checks the return value against exactly -1, rather than < 0. As a result, the hardware absence error is masked, allowing the driver to improperly proceed with initialization. It eventually calls agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware does not exist, node_to_amd_nb(0) returns NULL, leading to a General Protection Fault (GPF) when accessing its ->misc member. Fix the issue by correcting the error check in agp_amd64_probe() to abort properly when cache_nbs() returns any negative error code. This prevents the driver from erroneously proceeding without hardware, thereby avoiding the subsequent NULL pointer dereference at its source.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel AMD64 AGP driver contains a flaw in agp_amd64_probe() where error propagation is broken. Specifically, when no AMD northbridge hardware is present (common in virtualized environments like qemu/kvm), cache_nbs() returns -ENODEV, but the probe function only checks for a return value of exactly -1 instead of any negative value. This causes the driver to continue initialization improperly, eventually calling agp_add_bridge() and amd64_fetch_size(), which dereferences a NULL pointer returned by node_to_amd_nb(0). The fix involves correcting the error check to abort on any negative return value from cache_nbs(), preventing the NULL pointer dereference and subsequent crash.
Potential Impact
The vulnerability results in a denial of service via a kernel crash (General Protection Fault) when the AMD64 AGP driver is used in virtualized environments without physical AMD northbridge hardware. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the AMD64 AGP driver in virtualized environments lacking AMD northbridge hardware or apply kernel updates once provided by the vendor that correct the error handling in agp_amd64_probe().
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vhjq-v866-4c7f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53325"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a42ed6d27e9c79719938ecc
Added to database: 06/29/2026, 22:10:53 UTC
Last enriched: 07/06/2026, 23:47:14 UTC
Last updated: 07/31/2026, 19:24:48 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.