Medium · 4.7 CVE-2019-16230 EUVD-2019-7037GHSA-rfxp-r28m-8gjr

drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL point…

Published Sep 11, 2019 · Updated May 28, 2026 · Assigned by mitre

Package: linux Package: linux Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-hwe Package: linux-azure Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-edge Package: linux-gcp Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-edge Package: linux-gke-4.15 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.8 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-kvm Package: linux-lts-xenial Package: linux-oem Package: linux-oem-5.6 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-raspi2 Package: linux-riscv Package: linux-riscv-5.8 Ecosystem: Debian Ecosystem: Ubuntu

Description

drivers/gpu/drm/radeon/radeon_display.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value, leading to a NULL pointer dereference. NOTE: A third-party software maintainer states that the work queue allocation is happening during device initialization, which for a graphics card occurs during boot. It is not attacker controllable and OOM at that time is highly unlikely

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	linux	No fix yet	—
Debian 13	linux	No fix yet	—
Debian 12	linux	No fix yet	—

Ubuntu