Executive brief
The Linux kernel's AMD GPU display driver can crash when certain display-related system calls are made before a video stream is properly initialized. This causes the kernel to panic and potentially crash the system, affecting systems with AMD graphics hardware.
Technical details
A NULL pointer dereference vulnerability exists in the amdgpu_dm_crtc_set_vblank() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c. The function dereferences acrtc_state->stream without checking if it is NULL when vblank is enabled or queried via DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached. This can be triggered by user-space applications (e.g., VKCTS WSI tests on RADV) that query display sequence information. The fix adds a NULL check on acrtc_state->stream in the enable path, matching existing checks elsewhere in the function. Patches have been merged into stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions (patched in stable branches)
Timeline
- 2026-08-26: disclosed
- 2026-08-23: patched