Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: use proper context for logging

The same as the rest of the code, get_ss_info_from_atombios() uses
calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
initialized only later in calc_pll_max_vco_construct(). Therefore, any
output using DC_LOG_SYNC() leads to a NULL pointer deference in
get_ss_info_from_atombios().

According to Sashiko, the very same problem exists in
dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.

To avoid accessing the NULL context, use clk_src->base.ctx->logger
everywhere. That context in base is initialized earlier in
dce110_clk_src_construct() and dce112_clk_src_construct(). Before
get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
above are actually called. This is done by redefining DC_LOGGER to
CTX->logger.

Before:
dce110_clk_src_construct() did:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
-> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx

After:
dce110_clk_src_construct() does:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses clk_src->base.ctx

(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Published: 2026-08-28
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A null pointer dereference occurs in the Linux kernel’s AMD display driver when a logging macro references an uninitialized context during GPU initialization. The bug originates from the misuse of a context pointer that is only set later in the construction process. When the logger attempts to use this uninitialized pointer, the kernel dereferences a null value and panics, causing a system-wide crash. The weakness is captured by CWE-476, indicating a classic null pointer dereference leading to a denial of service.

Affected Systems

All Linux systems running a kernel version that includes the drm/amd/display module before the upstream patch commit (6f16fcbb0c46…) are affected. This spans community kernel releases and any distribution kernels that have not yet incorporated the fix. The issue is limited to the AMD display driver and does not touch other kernel subsystems.

Risk and Exploitability

The CVSS and EPSS metrics are not publicly disclosed, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the crash yields a severe denial of service and might be leveraged by a local or privileged attacker who can trigger driver reinitialization or GPU mode‑setting to repeatedly cause the kernel panic. Exploitation requires local access to the target system with sufficient privileges to load or interact with the DRM driver, but it does not provide remote code execution on its own.

Generated by OpenCVE AI on August 28, 2026 at 12:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the upstream fix for the drm/amd/display driver (commit 6f16fcbb0c46…).
  • Upgrade to a distribution kernel version that has integrated the patch from the vendor’s security feed.
  • If an update is unavailable, unload or permanently disable the drm/amd/display kernel module to prevent the faulty logging path from being executed until a patched kernel is deployed.

Generated by OpenCVE AI on August 28, 2026 at 12:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Fri, 28 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios(). According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger. Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx (cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Title drm/amd/display: use proper context for logging
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:53:06.442Z

Reserved: 2026-08-26T14:34:25.786Z

Link: CVE-2026-80704

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:55.953

Modified: 2026-08-28T08:16:55.953

Link: CVE-2026-80704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T13:00:04Z

Weaknesses

No weakness.