Executive brief
The Linux kernel's AMD display driver contains a memory safety flaw in its plane reset function that can cause the kernel to access already-freed memory. If memory allocation fails during a graphics plane reset operation, the freed memory pointer is not properly cleared, potentially leading to system crashes or unpredictable behavior affecting display functionality.
Technical details
The vulnerability is a use-after-free flaw in the amdgpu_dm_plane_drm_plane_reset() function within the AMD Display Core (drivers/gpu/drm/amd/display). The vulnerable code freed the old plane state before attempting to allocate a new one; if the kzalloc() allocation failed, the function returned without updating the state pointer, leaving it pointing to already-freed memory. The fix reorders operations to allocate the new state first, ensuring that on allocation failure the old state remains valid and can be safely cleaned up later. The vulnerability is local to the kernel and affects the display subsystem, potentially accessible through graphics API calls or display configuration changes. A patch is available in the Linux kernel stable trees.
Affected products
- Linux Linux kernel affected versions prior to commit 98cad4bd1443975d972f4c7f705980da03722a22
Timeline
- 2026-06-29: disclosed: Patch submitted by Evgenii Burenchev
- 2026-07-01: patched: Upstream commit merged
- 2026-09-17: advisory: CVE-2026-93176 published