Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: set new_stream to NULL after release
In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.
If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.
Fix this by setting new_stream to NULL after the initial release.
(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dm_update_crtc_state() function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a use-after-free vulnerability. This issue could potentially lead to memory corruption or a denial of service.
Меры по смягчению последствий
To mitigate this issue on systems that do not require AMD graphics hardware, prevent the amdgpu module from loading:
- Create a configuration file in /etc/modprobe.d to disable the driver:
echo "install amdgpu /bin/true" > /etc/modprobe.d/disable-amdgpu.conf
- If the amdgpu module is already loaded in the running kernel, a system reboot is required for the configuration to take effect. Warning: Disabling this module prevents the initialization of AMD graphics adapters, which disables graphical desktop environments, display output, and GPU acceleration on systems relying on AMD hardware.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Under investigation | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 10 | kernel | Fixed | RHSA-2026:88477 | 23.10.2026 |
| Red Hat Enterprise Linux 8 | kernel-rt | Fixed | RHSA-2026:82806 | 14.10.2026 |
| Red Hat Enterprise Linux 8 | kernel | Fixed | RHSA-2026:82807 | 14.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:81552 | 13.10.2026 |
| Red Hat Enterprise Linux 9 | kernel | Fixed | RHSA-2026:81552 | 13.10.2026 |
| Shadow Migration Toolkit for Virtualization for RHEL 10 | kernel | Fixed | RHSA-2026:88477 | 23.10.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: set new_stream to NULL after release In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL. If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free. Fix this by setting new_stream to NULL after the initial release. (cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)
EPSS
7 High
CVSS3