Executive brief
A vulnerability was identified in the Linux kernel's AMD display driver that could lead to a system crash. The issue occurs when the system attempts to manage display settings for certain AMD graphics hardware without properly verifying internal software hooks. This could allow a local user to cause a denial-of-service condition, impacting system availability.
Technical details
A vulnerability exists in the 'drm/amd/display' component of the Linux kernel, specifically within the 'dce110_hwseq.c' file. The issue stems from a lack of function hook validation before invoking 'set_dsc_config', 'dp_set_dsc_config', and 'dp_set_dsc_pps_info_packet' during DSC (Display Stream Compression) cleanup for eDP (embedded DisplayPort) panels. An attacker with local access could trigger a null pointer dereference by forcing a code path where these function pointers are not initialized, leading to a kernel oops or system crash. Patches have been merged into multiple stable branches of the Linux kernel to add the necessary null checks.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.11, 6.12
Timeline
- 2025-12-10: other: Initial patch authored by AMD
- 2026-01-05: patched: Patch committed to mainline kernel
- 2026-05-08: advisory: CVE-2026-43320 published