AMD, Arm, and Nvidia Fix Security Flaws in Graphics and AI Chips
Three of the world's biggest chipmakers released patches this week for flaws that could let attackers crash systems or quietly read private data. Here is what each company fixed and who needs to act.
Key points
- AMD patched CVE-2026-43603, a NULL pointer dereference flaw in its Linux graphics driver that could crash affected systems, with fixes already out for EPYC, Athlon, Ryzen, Radeon, and Instinct chips as of July 2026.
- Arm fixed nine vulnerabilities in its Mali GPU drivers covering flaws that could expose kernel data or cause system crashes.
- Nvidia released a software update for its Triton Inference Server on Linux, resolving two high-severity issues: one that could crash the server, a second that could allow outsiders to read or alter data.
- SecMate researchers Maxime Rossi Bellom and Ramtine Tofighi Shirazi discovered and reported the AMD flaw.
AMD, Arm, and Nvidia each published security advisories on Tuesday, covering flaws in the graphics and AI processing chips that power everything from gaming laptops to hospital data servers.
What did each company actually fix?
AMD's fix addresses CVE-2026-43603, a bug in the Linux graphics driver for its GPUs. A GPU, or graphics processing unit, handles images and increasingly powers AI workloads. The flaw is a "NULL pointer dereference": the driver tries to use a piece of data before checking whether that data exists, and the machine crashes entirely. That's a denial-of-service condition, where the system becomes unresponsive.
According to AMD's advisory, the bug triggers when an application calls a specific graphics memory management interface to run a "clear" operation under certain compute-processing conditions. SecMate researchers Maxime Rossi Bellom and Ramtine Tofighi Shirazi found it. Patches for EPYC Embedded and Ryzen Embedded chips aren't due until October.
| Product line | Fix available |
|---|---|
| AMD EPYC, Athlon, Ryzen, Radeon, Instinct | July 2026 |
| AMD EPYC Embedded, Ryzen Embedded | October 2026 (planned) |
| Arm Valhall GPU, Arm 5th Gen GPU | Now |
| Arm Bifrost GPU | Now |
| Nvidia Triton Inference Server (Linux) | Now |
Arm published a broader advisory covering nine vulnerabilities in its Mali GPU drivers, the software layer that lets a chip talk to an operating system. The flaws could let a malicious program access memory that has already been released (think of a filing cabinet drawer that was emptied but not locked, and someone else rifles through it) or read sensitive internal kernel information. Fixes are out for Valhall, 5th Gen, and older Bifrost driver lines.
Nvidia's update targets its Triton Inference Server, software companies use to run AI models at scale on Linux systems. Two high-severity flaws were fixed. Our 26 August story on Nvidia's previous patch release noted that Nvidia's AI tooling has drawn consistent researcher attention; Tuesday's advisory shows that pattern continuing.
Should ordinary people be worried?
Directly, most consumers aren't at immediate personal risk. These flaws sit deep inside driver and server software, and exploiting them generally requires an attacker to already have some access to the affected system. The real concern is for IT teams running AMD-powered Linux servers, cloud infrastructure on Arm chips, or AI pipelines built on Triton.
If your organisation uses any of these products, check that the relevant patches have been applied. For AMD's embedded lines, the October patch window is real and interim mitigations may be needed. No confirmed active exploitation had been reported at the time of publishing.
What matters most here is the embedded chip delay. Everything else ships now; those October-bound Embedded fixes leave a window that's hard to close quietly, and organisations running AMD EPYC Embedded in edge or industrial kit should be asking their vendors about workarounds today.
Common questions
Do I need to do anything if I just have an AMD or Nvidia graphics card in my home PC?
Probably not right away. The AMD flaw is in a Linux driver, so Windows home users aren't affected by this particular bug. Keep your drivers updated as a general habit, using the chipmaker's official software.
What is a patch, and how do I get one?
A patch is a small software update that fixes a specific flaw. IT teams apply these centrally for business systems. On personal devices, enabling automatic updates handles most patches without any action from you.
