Executive brief
A vulnerability in the Linux kernel's AMD display driver could allow a local user to crash the system or potentially access sensitive memory. The issue occurs when the system attempts to process specific display messages through a debug interface, particularly during hardware events like hot-plugging a monitor. This could lead to a denial-of-service (system crash) or unauthorized data exposure on affected Linux systems using AMD graphics hardware.
Technical details
A vulnerability exists in the `dp_sdp_message_debugfs_write()` function within the `amdgpu_dm_debugfs.c` component of the Linux kernel's AMD display driver. The function fails to validate if a connector is bound to a CRTC before dereferencing `connector->base.state->crtc`, leading to a NULL pointer dereference and kernel panic during specific states like hot-plugging. Additionally, the function ignores the user-provided size argument and performs a fixed 36-byte `copy_from_user()` call, resulting in a buffer over-read if the provided buffer is smaller than 36 bytes. Attackers with access to the debugfs interface can exploit these flaws to cause a denial-of-service or read sensitive kernel memory. Patches have been merged into multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.2 to 7.1
Timeline
- 2026-05-11: other: Initial patch authored
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f
- https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3
- https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479
- https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af
- https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4
- https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187
- https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e