Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Avoid DPMS-on for phantom stream

[Why & How]
Calling dc_update_planes_and_stream separately for stream and its
phantom stream causes a NULL pointer dereference, since the phantom is
destroyed on the first call.

Skip the call for phantom streams.
Published: 2026-09-24
Score: 7.0 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Kernel Crash)
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a null pointer dereference in the drm/amd/display subsystem that occurs when dc_update_planes_and_stream is called separately for a stream and its phantom. The dereference can trigger a kernel panic, causing the system to reboot or become unresponsive, representing a denial of service. This weakness is classified as a null pointer dereference (CWE-476).

Affected Systems

The flaw lies in the Linux kernel’s AMD display driver (drm/amd/display). Any Linux kernel build that contains the vulnerable code, including commonly used distributions that ship with the default AMD display module, is at risk. No specific version range is enumerated, but all kernels prior to the patch commit should be treated as affected.

Risk and Exploitability

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and the EPSS score is <1%, yet the CVSS score of 7.0 indicates a high severity. An attacker with local access that can trigger display updates, such as a user session that launches a graphical application, could exploit the fault to crash the kernel. The risk warrants prompt patching.

Generated by OpenCVE AI on October 1, 2026 at 15:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the kernel to a version that incorporates the patch removing phantom stream calls; the relevant commit can be applied from the provided kernel repository links.
  • As an interim workaround, disable DPMS or prevent phantom streams from being created in the display configuration to avoid the trigger that leads to the null dereference.
  • If an immediate kernel upgrade is not possible, consider unloading or disabling the AMD display driver until the kernel update can be applied.

Generated by OpenCVE AI on October 1, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 03:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream [Why & How] Calling dc_update_planes_and_stream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip the call for phantom streams.
Title drm/amd/display: Avoid DPMS-on for phantom stream
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-25T12:44:07.741Z

Reserved: 2026-09-24T14:53:16.869Z

Link: CVE-2026-97431

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T17:17:21.123

Modified: 2026-09-25T13:17:26.733

Link: CVE-2026-97431

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-97431 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T15:45:08Z

Weaknesses