CVE-2026-68235 - Vulnerability Details

- drm/amd/display: dce100: skip non-DP stream encoders for DP MST

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: dce100: skip non-DP stream encoders for DP MST

On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital
DIG stream encoders plus one analog DAC encoder. When assigning a stream
encoder for a second DisplayPort MST stream, if the preferred digital
encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link()
falls back to the first free pool entry. That entry may be the analog
encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute.
The subsequent atomic commit then dereferences NULL function pointers in
link_set_dpms_on() and crashes.

Skip encoders without dp_set_stream_attribute when the stream uses a DP
signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST
fallback path instead of checking only the link connector signal.

Tested on:
- GPU: AMD Radeon R7 260X (Bonaire / DCE8)
- Board: Supermicro C9X299-PG300
- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot
- Kernel: 7.1.3 (issue observed since 6.19)
- Result: kernel oops without patch; dual monitors stable with patch

(cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)

Published: 2026-08-10

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference in AMD’s DRM driver causes the kernel to oops when a second DisplayPort Multi‑Stream Transport (MST) stream is allocated. On DCE8‑class GPUs the driver may pick an analog encoder for the second stream, which lacks the required DP functions, leading to a crash during atomic commit.

Affected Systems

All Linux kernel builds up through 7.1.2 that include the AMD DRM module for DCE8‑class ASICs, such as the Radeon R7 260X (Bonaire). The flaw is observable when a second monitor is hot‑plugged or enabled at boot in a DP MST daisy‑chain configuration.

Risk and Exploitability

The CVSS score is 4.4, indicating moderate severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation in the wild. The vulnerability does not appear in CISA’s KEV catalog. The likely attack vector involves local control of the hardware to trigger the second MST stream, such as hot‑plugging a monitor or enabling a second display; it is not explicitly documented as remotely exploitable.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5834c33fd3f6f2a26dd4d6d4bbc7b8ed1c2ac4aa`	affected	< ed2d86aef9fa4c43f82da0fca91a60f7326d7d03
`5834c33fd3f6f2a26dd4d6d4bbc7b8ed1c2ac4aa`	affected	< d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bfe28ce019c2d667d98071262da33d8bba122919)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,51ea665c30c424c98959101f3bf6f48ab42949c8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ed2d86aef9fa4c43f82da0fca91a60f7326d7d03)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5)`	affected	code_commit	—
`[0,6.12.101)`	affected	semver	—
`[0,6.18.42)`	affected	semver	—
`[0,7.1.6)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc4,*)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the patch, such as 7.1.3 or later, or any kernel that includes the commit that fixes the encoder selection logic.
After updating, test the DisplayPort MST path by connecting a second monitor in a daisy‑chain or by hot‑plugging to verify that the kernel no longer crashes.
If a kernel upgrade is not possible at the moment, temporarily disable DisplayPort MST or restrict the system to a single monitor configuration until a patched kernel is available.

Generated by OpenCVE AI on August 13, 2026 at 07:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00198.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/51ea665c30c424c98959101f3bf6f48ab42949c8
https://git.kernel.org/stable/c/bfe28ce019c2d667d98071262da33d8bba122919
https://git.kernel.org/stable/c/d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5
https://git.kernel.org/stable/c/ed2d86aef9fa4c43f82da0fca91a60f7326d7d03
https://nvd.nist.gov/vuln/detail/CVE-2026-68235
https://www.cve.org/CVERecord?id=CVE-2026-68235

History

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68235 https://www.cve.org/CVERecord?id=CVE-2026-68235
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second DisplayPort MST stream, if the preferred digital encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link() falls back to the first free pool entry. That entry may be the analog encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute. The subsequent atomic commit then dereferences NULL function pointers in link_set_dpms_on() and crashes. Skip encoders without dp_set_stream_attribute when the stream uses a DP signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST fallback path instead of checking only the link connector signal. Tested on: - GPU: AMD Radeon R7 260X (Bonaire / DCE8) - Board: Supermicro C9X299-PG300 - Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot - Kernel: 7.1.3 (issue observed since 6.19) - Result: kernel oops without patch; dual monitors stable with patch (cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)
Title		drm/amd/display: dce100: skip non-DP stream encoders for DP MST
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/51ea665c30c424c98959101f3bf6f48ab42949c8 https://git.kernel.org/stable/c/bfe28ce019c2d667d98071262da33d8bba122919 https://git.kernel.org/stable/c/d340cba0df4cf327c7e89c7c1a4e79d4771d7dd5 https://git.kernel.org/stable/c/ed2d86aef9fa4c43f82da0fca91a60f7326d7d03

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:01:00.099Z

Updated: 2026-08-18T06:55:45.652Z

Reserved: 2026-07-30T09:28:09.376Z

Link: CVE-2026-68235

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:11.827

Modified: 2026-08-18T07:16:50.750

Link: CVE-2026-68235

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:01:00Z

Links: CVE-2026-68235 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:30:06Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object