Linux Kernel NULL Pointer Dereference Vulnerability in AMD GPU Driver

A vulnerability in the Linux kernel's AMD GPU driver can lead to a NULL pointer dereference. This issue arises when a command submission (cs) is made with zero chunks, causing a kernel oops by attempting to execute the incorrect userspace driver. The problem was observed in Linux kernel version 5.10.81 on NixOS, while running a Mesa application with the V3D driver override.

Impact

Exploitation of this vulnerability causes a kernel oops due to a NULL pointer dereference, disrupting normal kernel operations and potentially leading to a system crash.

Reproduction

The vulnerability can be reproduced by submitting a command to the AMD GPU driver with zero chunks, while the MESA_LOADER_DRIVER_OVERRIDE environment variable is set to 'v3d'. This can be done using the 'glxinfo' command.