Executive brief
The Linux kernel's AMD display driver contains a divide-by-zero vulnerability in its color lookup table (LUT) validation function. When processing a LUT with fewer than two entries, the function attempts to divide by zero, causing a kernel crash (divide error). This can be exploited by an attacker with local access to trigger a denial of service by providing malformed display color data.
Technical details
The vulnerability is a divide-by-zero error in the __is_lut_linear() function in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c. The function computes an expected value using the formula: expected = i * MAX_DRM_LUT_VALUE / (size - 1). When called with a single-entry LUT, size - 1 evaluates to zero, triggering a #DE (divide error) exception that crashes the kernel. The fix adds a bounds check to return false immediately if size is less than 2, preventing the division by zero. A patch has been applied upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions (fix backported across stable branches from linux-4.0.y through linux-7.2.y)
Timeline
- 2026-08-04: patched: Fix authored by Harry Wentland
- 2026-09-16: advisory: Vulnerability published on NVD