In the AMD display driver of the Linux kernel, a race condition exists when the physical layer finite state machine transitions from TX_EN to PLL_ON for TMDS on DCN35. The transition is not performed atomically, which can allow the OTG subsystem to remain stuck after TMDS is disabled. This stuck state can prevent the DCHVM from acknowledging invalidations, potentially leading to a kernel hang or system unresponsiveness.

All Linux kernel installations that include the AMD DCN35 display driver and have not applied the backported DCN401 fix are affected. The issue is present in any kernel version containing the unpatched DCN35 code, regardless of distribution.

The vulnerability requires the ability to manipulate the driver’s state, such as disabling eDP output, which implies a local or privileged attacker. No remote code execution path is described, and no active exploitation is known. The CVSS score of 5.5 indicates a medium severity, and the EPSS score of <1% indicates a very low probability of exploitation; the vulnerability is not listed in the CISA KEV catalog, suggesting that, while the potential for a system-wide hang exists, exploitation is unlikely without local access.