Executive brief
A vulnerability in the AMD graphics driver for Linux could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when the system incorrectly handles display configuration changes, such as plugging in external monitors to a laptop. This can lead to memory corruption, affecting system stability and the security of user data.
Technical details
A use-after-free vulnerability exists in the Linux kernel's amdgpu driver within the DRM display component. The root cause is an incorrect reset of the 'mode_changed' flag to false during DSC pre-validation in the atomic check process. When a change in MST/DSC configuration occurs simultaneously with an unrelated mode change (e.g., HDR toggling), the driver may fail to release old streams or acquire references to new ones. This leads to a memory leak followed by a use-after-free when the stream is later disabled, specifically within 'dc_stream_release'. The vulnerability is reachable by local users through display configuration changes and has been patched in various stable kernel branches.
Affected products
- Linux Linux kernel 5.18.1 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-04-22: advisory: CVE-2026-31488 published
- 2026-04-02: patched: Fix committed to stable kernel trees
References
- https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7
- https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33
- https://git.kernel.org/stable/c/21159d8b335a6b9f44cbb506733013a902ae2da4
- https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8
- https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025