CVE-2026-80704 - Vulnerability Details

- drm/amd/display: use proper context for logging

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: use proper context for logging

The same as the rest of the code, get_ss_info_from_atombios() uses
calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
initialized only later in calc_pll_max_vco_construct(). Therefore, any
output using DC_LOG_SYNC() leads to a NULL pointer deference in
get_ss_info_from_atombios().

According to Sashiko, the very same problem exists in
dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.

To avoid accessing the NULL context, use clk_src->base.ctx->logger
everywhere. That context in base is initialized earlier in
dce110_clk_src_construct() and dce112_clk_src_construct(). Before
get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
above are actually called. This is done by redefining DC_LOGGER to
CTX->logger.

Before:
dce110_clk_src_construct() did:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
-> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx

After:
dce110_clk_src_construct() does:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses clk_src->base.ctx

(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)

Published: 2026-08-28

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference occurs in the Linux kernel’s AMD display driver when a logging macro references an uninitialized context during GPU initialization. The bug originates from the misuse of a context pointer that is only set later in the construction process. When the logger attempts to use this uninitialized pointer, the kernel dereferences a null value and panics, causing a system-wide crash. This classic null pointer dereference leads to a denial of service.

Affected Systems

All Linux systems running a kernel version that includes the drm/amd/display module before the upstream patch commit (6f16fcbb0c46…) are affected. This spans community kernel releases and any distribution kernels that have not yet incorporated the fix. The issue is limited to the AMD display driver and does not touch other kernel subsystems.

Risk and Exploitability

The CVSS score is 5.5, and the EPSS score indicates an exploit probability of less than 1%. The vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the crash yields a moderate denial of service and might be leveraged by a local or privileged attacker who can trigger driver reinitialization or GPU mode‑setting to repeatedly cause the kernel panic. Exploitation requires local access to the target system with sufficient privileges to load or interact with the DRM driver, but it does not provide remote code execution on its own.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1296423bf23c7a58133970e223b1f47ec6570308`	affected	< a94e62b7c7018fcfe0251e53fa96af30f12d923a
`1296423bf23c7a58133970e223b1f47ec6570308`	affected	< 02647d98340738f918690ed227fdcf154db1b84a
`1296423bf23c7a58133970e223b1f47ec6570308`	affected	< f556bc844cc4423e5ad41ae41a4c24f1cf75b978
`1296423bf23c7a58133970e223b1f47ec6570308`	affected	< 114b42507b6a23d9d24e24e4ef165233332c64d4

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1296423bf23c7a58133970e223b1f47ec6570308,a94e62b7c7018fcfe0251e53fa96af30f12d923a)`	affected	code_commit	—
`[1296423bf23c7a58133970e223b1f47ec6570308,02647d98340738f918690ed227fdcf154db1b84a)`	affected	code_commit	—
`[1296423bf23c7a58133970e223b1f47ec6570308,f556bc844cc4423e5ad41ae41a4c24f1cf75b978)`	affected	code_commit	—
`[1296423bf23c7a58133970e223b1f47ec6570308,114b42507b6a23d9d24e24e4ef165233332c64d4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that contains the upstream fix for the drm/amd/display driver (commit 6f16fcbb0c46…).
Upgrade to a distribution kernel version that has integrated the patch from the vendor’s security feed.
If an update is unavailable, unload or permanently disable the drm/amd/display kernel module to prevent the faulty logging path from being executed until a patched kernel is deployed.

Generated by OpenCVE AI on September 1, 2026 at 15:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00159.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a
https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4
https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a
https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978
https://lore.kernel.org/linux-cve-announce/2026082807-CVE-2026-80704-04d4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80704
https://www.cve.org/CVERecord?id=CVE-2026-80704

History

Tue, 01 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026082807-CVE-2026-80704-04d4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80704 https://www.cve.org/CVERecord?id=CVE-2026-80704
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 28 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 28 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Fri, 28 Aug 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios(). According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger. Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx (cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Title		drm/amd/display: use proper context for logging
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4 https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-28T06:53:06.442Z

Updated: 2026-08-28T06:53:06.442Z

Reserved: 2026-08-26T14:34:25.786Z

Link: CVE-2026-80704

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-28T08:16:55.953

Modified: 2026-08-28T08:16:55.953

Link: CVE-2026-80704

Redhat

Severity : Low

Publid Date: 2026-08-28T00:00:00Z

Links: CVE-2026-80704 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-01T15:15:12Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object