Description
In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: skip PUSH_IDLE when the link was never enabled

msm_dp_display_atomic_enable() returns early when link training fails,
leaving ->power_on false and the main link down.
msm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE
and waits for an idle-pattern completion that cannot arrive, so every failed
enable is followed by "PUSH_IDLE pattern timedout".

Every other step of the teardown is already gated on that flag:
msm_dp_display_disable(), called from .atomic_post_disable(), returns early
on !power_on. The PUSH_IDLE write is the only one that is not, so the
controller's runtime-PM reference is then dropped without the link having
been taken down.

On glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC
does not survive it: TrustZone force-stops the SOCCP and ADSP remote
processors and the machine resets silently about 50 ms later, with no oops
and no panic. On an ASUS Zenbook A16 (UX3607OA), whose eDP panel does not
currently train, this reproduces without any compositor or GPU involvement:

# eDP enable has already failed with "Failed link training (rc=-104)"
echo 1 > /sys/class/graphics/fb0/blank

[535.645455] === marker ===
[535.694833] qcom_q6v5_pas d00000.remoteproc: fatal error received: \
sys_m_smsm.c:512:TZ force stop
[535.694875] remoteproc remoteproc0: crash detected in soccp: type fatal error
[535.728857] qcom_q6v5_pas 6800000.remoteproc: fatal error received: \
sys_m_smsm.c:783:err fatal notification received from TZ
<SoC reset>

Gate the PUSH_IDLE write on ->power_on so the disable path is consistent
with the rest of the teardown. With this applied the same sequence is
harmless and the machine stays up; without it, it resets every time.

The unconditional write dates back to the original DP driver
(c943b4948b58 ("drm/msm/dp: add displayPort driver support")), but the
surrounding code has been restructured several times since, so no Fixes:
tag is offered.

Note that the eDP link-training failure that exposes this on the A16 is a
separate problem in the glymur eDP PHY and is reported separately; this
change is about not damaging the machine when training fails, for whatever
reason.

Tested on ASUS Zenbook A16 (UX3607OA), Snapdragon X2 Elite Extreme, on
linux-next next-20260803 and next-20260807. The machine has since been
running next-20260807 with this patch as its daily driver.

Patchwork: https://patchwork.freedesktop.org/patch/745167/
Published: 2026-10-06
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service causing abrupt system reset
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel DisplayPort driver writes to the PUSH_IDLE register even when the link has never been enabled. This causes the runtime power‑management reference on the controller to be released without the link actually being taken down. The consequence is a forced stop of critical system components by TrustZone, followed by an immediate SoC reset that occurs silently within a few milliseconds, with no kernel panic or oops message reported. The flaw is a result of insufficient guarding of the hardware write and can lead to a total loss of system stability.

Affected Systems

The issue affects the Linux kernel, specifically builds that include the MSM DisplayPort driver before the patch. Devices known to exhibit the problem include Qualcomm Snapdragon X2 Elite (Glymur) laptops and the ASUS Zenbook A16 (UX3607OA). The vendor identifiers are listed as Linux:Linux, and the product is the Linux kernel. Any system running a kernel version that lacks the patch will be susceptible when a DisplayPort link training failure occurs.

Risk and Exploitability

The CVSS base score of 5.5 indicates moderate severity, and the EPSS score is reported as less than 1%, reflecting a very low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with local or discretionary access who can influence the display subsystem (for example by forcing a DP enable/disable sequence or by manipulating the eDP panel) could trigger a link‑training failure that leads to an uncontrolled reboot. The attack vector is likely local, but it could also be exercised from user space processes that interact with the framebuffer.

Generated by OpenCVE AI on October 10, 2026 at 03:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that contains the patch, such as linux‑next 20260807 or later.
  • Disable eDP or DisplayPort functionality until the patch is applied—for example, by removing the corresponding kernel module or using boot parameters to prevent eDP usage.
  • If an upgrade is not immediately possible, manually apply the patch by pulling the relevant commits from the kernel source, recompiling the kernel, and installing the updated module.

Generated by OpenCVE AI on October 10, 2026 at 03:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 10 Oct 2026 02:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606

Sat, 10 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-908
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 06 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSH_IDLE when the link was never enabled msm_dp_display_atomic_enable() returns early when link training fails, leaving ->power_on false and the main link down. msm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE and waits for an idle-pattern completion that cannot arrive, so every failed enable is followed by "PUSH_IDLE pattern timedout". Every other step of the teardown is already gated on that flag: msm_dp_display_disable(), called from .atomic_post_disable(), returns early on !power_on. The PUSH_IDLE write is the only one that is not, so the controller's runtime-PM reference is then dropped without the link having been taken down. On glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC does not survive it: TrustZone force-stops the SOCCP and ADSP remote processors and the machine resets silently about 50 ms later, with no oops and no panic. On an ASUS Zenbook A16 (UX3607OA), whose eDP panel does not currently train, this reproduces without any compositor or GPU involvement: # eDP enable has already failed with "Failed link training (rc=-104)" echo 1 > /sys/class/graphics/fb0/blank [535.645455] === marker === [535.694833] qcom_q6v5_pas d00000.remoteproc: fatal error received: \ sys_m_smsm.c:512:TZ force stop [535.694875] remoteproc remoteproc0: crash detected in soccp: type fatal error [535.728857] qcom_q6v5_pas 6800000.remoteproc: fatal error received: \ sys_m_smsm.c:783:err fatal notification received from TZ <SoC reset> Gate the PUSH_IDLE write on ->power_on so the disable path is consistent with the rest of the teardown. With this applied the same sequence is harmless and the machine stays up; without it, it resets every time. The unconditional write dates back to the original DP driver (c943b4948b58 ("drm/msm/dp: add displayPort driver support")), but the surrounding code has been restructured several times since, so no Fixes: tag is offered. Note that the eDP link-training failure that exposes this on the A16 is a separate problem in the glymur eDP PHY and is reported separately; this change is about not damaging the machine when training fails, for whatever reason. Tested on ASUS Zenbook A16 (UX3607OA), Snapdragon X2 Elite Extreme, on linux-next next-20260803 and next-20260807. The machine has since been running next-20260807 with this patch as its daily driver. Patchwork: https://patchwork.freedesktop.org/patch/745167/
Title drm/msm/dp: skip PUSH_IDLE when the link was never enabled
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:17:23.779Z

Reserved: 2026-09-25T10:25:14.339Z

Link: CVE-2026-98313

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:22.887

Modified: 2026-10-19T10:18:33.410

Link: CVE-2026-98313

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98313 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T03:30:16Z

Weaknesses
  • CWE-908

    Use of Uninitialized Resource