AMD says a Radeon crash fix is planned, and its own tables date it to July 20
AMD's security bulletin for a crash in its Linux graphics driver says a fix "is planned", and the same document lists the mitigation for 30 of its product rows as a driver with a release date of July 20, 2026. The bulletin is AMD-SB-6034, "Linux GPU Driver NULL Pointer Dereference", first published on September 8 and revised on October 6. It was read at 21:41 UTC on October 10.
The flaw is CVE-2026-43603, scored at CVSS 6.9 with the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, and classified CWE-476. Researchers "reported a NULL pointer dereference in the AMD GPU Linux kernel driver that could allow a local user to trigger a system crash, potentially resulting in a denial-of-service condition", AMD says. An application calling a graphics memory management interface to perform a "clear" operation under certain compute conditions can reach code where "the driver may fail to validate an internal data reference before use".
The vector is the reassuring part. AV:L means a local attacker, and VC:N and VI:N mean no data is exposed and nothing is altered. What an attacker gets is a kernel crash.
AMD's summary and its mitigation tables disagree
AMD's summary ends on this sentence: "AMD has reviewed the report and has identified the issue described. An update to the affected driver is planned to help address this behavior." Every consumer row in the mitigation tables, meanwhile, gives the fix as "Radeon Software for Linux 26.13" with a mitigation release date of 2026-07-20, seven weeks before the bulletin was first published. AMD does not reconcile the two, and the October 6 revision describes one change and only one: "Removed AMD EPYC and AMD Ryzen Embedded Series Processors due to no impact".
42 rows, counted from the tables
Counting the rows in the Affected Products and Mitigation tables by hand gives 42 entries, each naming CVE-2026-43603 once. Thirty of them point at Radeon Software for Linux 26.13 dated 2026-07-20, nine Instinct accelerators from MI210 to MI355X point at "Linux GPU Driver 31.40" dated 2026-07-15, and three Radeon PRO V series parts name no version at all, only "Please contact your AMD Customer Engineering Representative".
The 30 rows that name 26.13 cover most of AMD's recent graphics hardware. They run from Radeon RX 5000 through RX 6000 and RX 7000 to RX 9000, take in the Radeon PRO W5000, W6000 and W7000 cards and the Radeon AI PRO R9000 series, and then cover Ryzen chips with Radeon graphics from the 4000 series desktop and mobile parts up through Ryzen 9000, Ryzen 9000HX, Ryzen AI 300, Ryzen AI 400 and Ryzen AI Max 300, plus Athlon 3000 mobile parts and the EPYC 4004 and 4005 series.
AMD names no upstream kernel patch anywhere in the bulletin and links no commit, so the driver package is the only version information it offers. Only Linux systems are in scope. The driver named throughout is AMD's packaged Radeon Software for Linux, and nothing in the bulletin touches the Adrenalin driver on Windows, where AMD has kept older Radeon cards on a separate driver base since July.
AMD credits the report to "Maxime Rossi Bellom and Ramtine Tofighi Shirazi from SecMate". A separate September advisory for the Instinct line carried two CVE numbers for one flaw before AMD corrected it. Here there is one number to track, CVE-2026-43603, and one driver version named against consumer hardware, 26.13.
