Executive brief
The Linux kernel's AMD display driver has a division-by-zero flaw in bandwidth allocation logic for USB4/DPIA tunneling connections. When a USB4 device reports a bandwidth change before sending capability information, the driver crashes, potentially causing kernel panics or system hangs on systems using AMD GPUs with USB4 displays.
Technical details
A division-by-zero vulnerability exists in the get_estimated_bw() function in drivers/gpu/drm/amd/display/dc/link/protocols/link_dp_dpia_bw.c. The function divides by link->dpia_bw_alloc_config.bw_granularity, which is initialized to zero by reset_bw_alloc_struct() and only populated after DP_TUNNELING_BW_ALLOC_CAP_CHANGED is handled. The DPCD interrupt handler link_dp_dpia_handle_bw_alloc_status() calls get_estimated_bw() whenever DP_TUNNELING_ESTIMATED_BW_CHANGED is signaled, regardless of whether capability change has occurred. A USB4/DPIA device reporting estimated-bandwidth change before capability change triggers the division by zero in the IRQ path. The fix adds a guard checking if bw_granularity is zero before dividing, mirroring existing checks in link_dpia_send_bw_alloc_request().
Affected products
- Linux Linux kernel affected versions across linux-5.x through linux-7.x stable branches
Timeline
- 2026-09-16: disclosed: CVE-2026-90035 published
- 2026-09-11: patched: Patch committed to stable tree by Greg Kroah-Hartman