Executive brief
The Linux kernel's AMD display driver contains a null pointer dereference bug in its clock source initialization code. When the driver initializes display hardware clocks, it attempts to log diagnostic messages using an uninitialized logger pointer, causing the system to crash. This affects systems using AMD GPUs during driver initialization.
Technical details
A null pointer dereference vulnerability exists in the drm/amd/display driver's clock source initialization, specifically in the get_ss_info_from_atombios(), dce112_get_pix_clk_dividers(), and dcn3_get_pix_clk_dividers() functions. The vulnerable code attempts to access calc_pll_cs->ctx->logger for logging before calc_pll_cs->ctx is initialized in calc_pll_max_vco_construct(). The fix redefines the DC_LOGGER macro to use clk_src->base.ctx->logger instead, which is initialized earlier in the construction sequence. This allows logging to proceed safely without dereferencing a null pointer. The vulnerability can be triggered during normal driver initialization when the affected code paths are executed.
Affected products
- Linux Linux kernel multiple (patched in stable branches)
Timeline
- 2026-07-23: disclosed
- 2026-07-28: patched
- 2026-08-28: advisory