Executive brief
The Linux kernel's AMD display driver failed to validate user-supplied plane degamma lookup table (LUT) sizes, allowing a malformed color property to trigger a divide-by-zero error or out-of-bounds memory read. This could enable a local attacker to crash the system or potentially execute code with kernel privileges.
Technical details
The AMD display driver's __set_dm_plane_degamma() function accepted user-supplied degamma LUT size without validation, passing it directly to __is_lut_linear() and __drm_lut_to_dc_gamma(). A malformed AMD_PLANE_DEGAMMA_LUT blob with an incorrect size (e.g., a single entry instead of MAX_COLOR_LUT_ENTRIES) could trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(), which unconditionally iterates MAX_COLOR_LUT_ENTRIES entries. The vulnerability requires local access to set plane properties via the DRM subsystem. The fix adds an explicit size validation check to reject any degamma LUT whose size does not match the expected MAX_COLOR_LUT_ENTRIES constant, mirroring the existing CRTC degamma path validation. This is a memory corruption and denial-of-service vulnerability present only in builds with AMD_PRIVATE_COLOR enabled.
Affected products
- Linux Linux kernel All versions with AMD_PRIVATE_COLOR support (introduced in 980f8710075a)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Patch included in stable kernel updates (commits 0b2615b8b54f58bbdf986dffb38cbc35214a5cc5 and b10cc09b329245c6d95f8fa3e7f068575e3e0e9f)
- 2026-08-04: other: Original upstream commit e4c3ab59021e7c146a84b6671f0d530972bd58b4 by Harry Wentland