Back to Security Bulletins and Briefs

AMD Graphics Driver for Linux®

AMD ID:   AMD-SB-6021
Potential Impact: Varies by CVE, see descriptions below
Severity: Varies by CVE, see descriptions below

Summary

Researchers have reported potential vulnerabilities affecting AMD Graphics Driver for Linux®.

CVE Details

Refer to Glossary for explanation of terms

CVE

CVSS Score

CVE Description
CVE-2023-52921
(Assigned by Linux Kernel Project)

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

https://nvd.nist.gov/vuln/detail/CVE-2023-52921

CVE-2024-41008
(Assigned by Linux Kernel Project)

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

https://nvd.nist.gov/vuln/detail/CVE-2024-41008

CVE-2024-26656
(Assigned by Linux Kernel Project)

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

https://nvd.nist.gov/vuln/detail/cve-2024-26656

CVE-2024-26657
(Assigned by Linux Kernel Project)

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

https://nvd.nist.gov/vuln/detail/cve-2024-26657

CVE-2024-27400
(Assigned by Linux Kernel Project)

5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

https://nvd.nist.gov/vuln/detail/cve-2024-27400

Affected Products and Mitigation

AMD recommends updating to the AMD graphics driver version (or later) indicated below. 

Mitigations for affected products may also be available through Linux Kernel updates.  Please refer to the Linux Kernel documentation for more information.

Graphics Cards

Applicable CVE(s)

CVSS Score

AMD Radeon™ RX 5000 Series Graphics Cards
AMD Radeon™ RX 6000 Series Graphics Cards
AMD Radeon™ RX 7000 Series Graphics Cards

AMD Radeon™ PRO W5000 Series Graphics Cards
AMD Radeon™ PRO W6000 Series Graphics Cards
AMD Radeon™ PRO W7000 Series Graphics Cards

CVE-2023-52921

7.8 (High)

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.20.3
(2024-10-10)

CVE-2024-41008

5.5 (Medium)

Radeon Software for Linux 24.30.2
(2025-01-30)

Radeon Software for Linux 24.30.2
(2025-01-30)

CVE-2024-27400

5.5 (Medium)

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.20.3
(2024-10-10)

CVE-2024-26656

4.7 (Medium)

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.20.3
(2024-10-10)

CVE-2024-26657

4.4 (Medium)

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.20.3
(2024-10-10)

Data Center Graphics

Applicable CVE(s)

CVSS Score

AMD Radeon™ Instinct™ MI50 Series

AMD Instinct™ MI100 Series

AMD Instinct™ MI200 Series

AMD Instinct™ MI300 Series

CVE-2023-52921

7.8 (High)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

CVE-2024-41008

5.5 (Medium)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

CVE-2024-27400

5.5 (Medium)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

CVE-2024-26656

4.7 (Medium)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

CVE-2024-26657

4.4 (Medium)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

ROCm 6.2
(2024-08-02)

Applicable CVE(s)

CVSS Score

AMD Radeon™ PRO V520

AMD Radeon™ PRO V620

AMD Radeon™ PRO V710

CVE-2023-52921

7.8 (High)

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

CVE-2024-41008

5.5 (Medium)

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

CVE-2024-27400

5.5 (Medium)

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

CVE-2024-26656

4.7 (Medium)

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

CVE-2024-26657

4.4 (Medium)

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Contact your AMD Customer Engineering representative

Client

Product

CVE-2023-52921

CVE-2024-41008

CVE-2024-27400
CVE-2024-26657

CVE-2024-26656

AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (formerly codenamed "Picasso")

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.30.2
(2025-01-30)

Radeon Software for Linux 24.20.3
(2024-10-10)

Radeon Software for Linux 24.20.3
(2024-10-10)

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dali")

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Picasso")

AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Pollock")

AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt")

AMD Ryzen™ 7000 Series Desktop Processors (formerly codenamed "Raphael"/"Raphael X3D")

AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics (formerly codenamed "Mendocino")

AMD Ryzen™ 7035 Series Processors with Radeon™ Graphics (formerly codenamed "Rembrandt R")

AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Phoenix")

AMD Ryzen™ 7045 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dragon Range")

AMD Ryzen™ 3000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Dali")

Not Affected

AMD Ryzen™ 4000 Series Desktop Processors (formerly codenamed "Renoir")

Not Affected

AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Renoir")

Not Affected

AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics (formerly codenamed "Cezanne")

Not Affected

AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo")

Not Affected

AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Cezanne")

Not Affected

AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Lucienne")

Not Affected

AMD Ryzen™ 8040 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Hawk Point")

Not Affected

AMD Ryzen™ 9000 Series Desktop Processors (formerly codenamed "Granite Ridge")

Not Affected

AMD Ryzen™ AI 300 Series Processors (formerly codenamed "Strix Point")

Not Affected

AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics (formerly codenamed "Barcelo R")

Not Affected

Not Affected

AMD Ryzen™ 8000 Series Desktop Processors (formerly codenamed "Phoenix")

Not Affected

Not Affected

AMD Ryzen™ 5000 Series Desktop Processors (formerly codenamed "Vermeer"/"Vermeer-X3D")

Not Affected

Not Affected

Not Affected

Acknowledgement

AMD thanks the following for reporting these issues and engaging in coordinated vulnerability disclosure.

Joonkyo Jung, Jisoo Jang, Yonsei University, Yongwan Jo (Department of Computer Science, Yonsei University); Jonas Vinck (DistriNet, KU Leuven); Alexios Voulimeneas (CYS, TU Delft); Stijn Volckaert (DistriNet, KU Leuven); Dokyung Song (Department of Computer Science, Yonsei University): CVE-2024-26656, CVE-2024-27400, CVE-2024-26657

Ye Zhang (@VAR10CK) of Baidu Security: CVE-2023-52921, CVE-2024-41008

Revisions 

Revision Date  

Description  

2025-02-25

Initial publication  

DISCLAIMER

The information contained herein is for informational purposes only and is subject to change without notice. While every precaution has been taken in the preparation of this document, it may contain technical inaccuracies, omissions and typographical errors, and AMD is under no obligation to update or otherwise correct this information. Advanced Micro Devices, Inc. makes no representations or warranties with respect to the accuracy or completeness of the contents of this document, and assumes no liability of any kind, including the implied warranties of noninfringement, merchantability or fitness for particular purposes, with respect to the operation or use of AMD hardware, software or other products described herein. Any computer system has risks of security vulnerabilities that cannot be completely prevented or mitigated. No license, including implied or arising by estoppel, to any intellectual property rights is granted by this document. Terms and limitations applicable to the purchase or use of AMD’s products are as set forth in a signed agreement between the parties or in AMD's Standard Terms and Conditions of Sale.

AMD, the AMD Arrow logo, Radeon and combinations thereof are trademarks of Advanced Micro Devices, Inc. CVE and the CVE logo are registered trademarks of The MITRE Corporation. Linux® is the registered trademark of Linus Torvalds in the U.S. and other countries. Other product names used in this publication are for identification purposes only and may be trademarks of their respective companies.

Third party content may be licensed to you directly by the third party that owns the content and is not licensed to you by AMD. ALL LINKED THIRD-PARTY CONTENT IS PROVIDED ‘AS IS’ WITHOUT A WARRANTY OF ANY KIND. USE OF SUCH THIRD-PARTY CONTENT IS DONE AT YOUR SOLE DISCRETION AND UNDER NO CIRCUMSTANCES WILL AMD BE LIABLE TO YOU FOR ANY THIRD PARTY CONTENT. YOU ASSUME ALL RISK AND ARE SOLELY RESPONSIBILITY FOR ANY DAMAGES THAT MAY ARISE FROM YOUR USE OF THIRD-PARTY CONTENT.

© 2025 Advanced Micro Devices, Inc. All rights reserved.