CVE-2026-98270

A low severity flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. The RAS controller interrupt handler nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences the RAS context and RAS object returned by amdgpu_ras_get_context() and amdgpu_ras_find_obj() without first checking them for NULL. During amdgpu device initialization there is a window in which the fatal-error interrupt is enabled before the PCIE_BIF RAS object has been created; if an interrupt arrives in this window, the handler dereferences a NULL pointer in hard-IRQ context, crashing the kernel and causing a local denial of service. Although the Red Hat CVSS 3.1 base score for this flaw is 5.5 (Moderate), Red Hat rates its impact as Low because triggering the crash requires a hardware error interrupt to arrive during the narrow driver initialization window, and the consequence is limited to availability with no impact on confidentiality or integrity. The vulnerable code, introduced with the DRM update based on upstream kernel v6.6, is present in Red Hat Enterprise Linux 9 (9.4 and later), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4.16 and later releases that ship RHEL CoreOS 9. Because of the low severity and the narrow conditions required to trigger the issue, fixes for these affected products have been deferred to a future update; the residual risk is a kernel crash (denial of service) during amdgpu driver initialization on systems with affected AMD GPU hardware. Red Hat Enterprise Linux 7, 8, and 9.2, and OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in those releases.