🟡 Medium | Source: Microsoft Security Response Center
CVE-2026-63882 is a NULL pointer dereference vulnerability in the Linux kernel’s AMD GPU driver component (drm/amdkfd), specifically within the svm_range_set_attr function used for shared virtual memory management. While originating in the Linux kernel, this vulnerability is relevant to Azure environments running Linux VMs with AMD GPU instances. If exploited, it could cause a kernel crash or potentially be leveraged for privilege escalation on affected workloads.
Security Architect’s Take: Identify any Azure VM deployments using AMD GPU-enabled SKUs (such as NVv4 series) running Linux, and ensure the underlying OS kernel is patched promptly. Review whether your organisation’s Linux VM images and AKS node pools with GPU workloads are on a patching cadence that covers kernel-level CVEs.
Original advisory: CVE-2026-63882 drm/amdkfd: fix NULL pointer bug in svm_range_set_attr