Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

If a plane reaches calculate_mcache_setting with a zero-area viewport,
calculate_mcache_setting exits early with num_mcaches == 0 and
mvmpg_width/height == 0. This will cause a divide-by-zero panic and can
also cause an underflow on num_mcaches.

Fix this by changing calculate_mcache_setting to bool and adding guards
after each calculate_mcache_row_bytes call. If num_mcaches or
mvmpg_width/height is zero, return a false. Callers will propagate the
failure as a rejected mode, which prevents the panic.

(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
Published: 2026-08-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A divide‑by‑zero error in the Linux kernel’s AMD display driver occurs when the calculate_mcache_setting function receives a plane with a zero‑area viewport. The function exits early with zero cache counts, leading to a subsequent division by zero that triggers a kernel panic or numeric underflow. This flaw results in an abrupt loss of service as the affected system crashes.

Affected Systems

All Linux kernel builds that include the drm/amd/display driver and contain the unpatched calculate_mcache_setting routine are affected. Any kernel snapshot prior to the inclusion of commit 29c0f7c6, which introduces guards against zero‑dimension values, remains vulnerable, regardless of the specific distribution or kernel release.

Risk and Exploitability

Based on the description, it is inferred that an attacker must be able to configure a display plane with a zero‑area viewport, a capability normally limited to local users with kernel privileges or those who have already compromised the kernel via another vector. No remote attack surface is described. The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, further indicating it is not a currently known high‑profile target. Nonetheless, because the flaw can trigger a kernel panic, patching is strongly advised.

Generated by OpenCVE AI on August 17, 2026 at 12:47 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Linux kernel to a version that includes the 29c0f7c6 commit which fixes the divide‑by‑zero guard.
  • Apply the patch to the drm/amd/display driver locally and rebuild the kernel if upgrading is not possible.
  • Avoid configuring display planes with zero‑area viewports until the kernel is patched.

Generated by OpenCVE AI on August 17, 2026 at 12:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 22 Aug 2026 00:15:00 +0000


Mon, 17 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-369

Mon, 17 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-369

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Sat, 15 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-369

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 and mvmpg_width/height == 0. This will cause a divide-by-zero panic and can also cause an underflow on num_mcaches. Fix this by changing calculate_mcache_setting to bool and adding guards after each calculate_mcache_row_bytes call. If num_mcaches or mvmpg_width/height is zero, return a false. Callers will propagate the failure as a rejected mode, which prevents the panic. (cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
Title drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-18T06:56:35.806Z

Reserved: 2026-08-15T05:44:03.899Z

Link: CVE-2026-74449

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:49.500

Modified: 2026-08-18T07:16:54.827

Link: CVE-2026-74449

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74449 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T13:00:13Z

Weaknesses