Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: guard dc_sink dereferences in MST mode validation

dm_dp_mst_is_port_support_mode() reads
aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check,
and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads
aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL
check. dc_sink is cleared asynchronously on MST unplug, and both
functions run from paths that the driver's own comments document as
racing that teardown: the connector probe worker's ->mode_valid
callback and a compositor's atomic check, neither of which holds the
MST manager lock that the teardown path uses. The former does have an
existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in
every path that clears dc_sink, so it doesn't cover this.

Fail the port-support check and skip the FRL conversion path when the
sink is already gone.

(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)
Published: 2026-10-18
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Kernel Crash / Denial of Service
Action: Apply Patch
AI Analysis

Impact

In older releases of the Linux kernel, the drm/amd/display driver lacks a null check before accessing the dc_sink structure during Multi‑Stream Transport (MST) validation. This flaw is a null pointer dereference (CWE-476). When an AMD display is disconnected, dc_sink can be cleared asynchronously. Subsequent calls to dm_dp_mst_is_port_support_mode() or get_conv_frl_bw() then dereference a null pointer, leading to a kernel crash and loss of availability for the affected machine.

Affected Systems

All Linux kernels that ship with the eglibc/drm/amd/display driver prior to the commit that introduced the null‑check guard are affected, regardless of distribution. Any system that uses a kernel built before that commit, with an AMD GPU supporting MST, is at risk.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity, while an EPSS of < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require local access or the ability to trigger an AMD display disconnect or a compositor atomic check, allowing a targeted denial‑of‑service attack. The available attack vector is inferred to be *local* rather than remote.

Generated by OpenCVE AI on October 23, 2026 at 19:12 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that adds a null‑check guard before accessing dc_sink, as included in commit 7c3db8da4e039698ae198c870712428644e965c7.
  • If an update is not yet available, blacklist or unload the drm/amd/display driver module so that the vulnerable code never loads into the kernel.
  • As a temporary measure, disable MST mode or avoid disconnecting AMD displays to reduce the chance that dc_sink becomes null while the validation logic runs.

Generated by OpenCVE AI on October 23, 2026 at 19:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
References

Fri, 23 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc_sink dereferences in MST mode validation dm_dp_mst_is_port_support_mode() reads aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check, and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL check. dc_sink is cleared asynchronously on MST unplug, and both functions run from paths that the driver's own comments document as racing that teardown: the connector probe worker's ->mode_valid callback and a compositor's atomic check, neither of which holds the MST manager lock that the teardown path uses. The former does have an existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in every path that clears dc_sink, so it doesn't cover this. Fail the port-support check and skip the FRL conversion path when the sink is already gone. (cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)
Title drm/amd/display: guard dc_sink dereferences in MST mode validation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-11-06T17:15:05.665Z

Reserved: 2026-09-25T10:25:14.370Z

Link: CVE-2026-98786

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:32.580

Modified: 2026-11-06T18:18:30.337

Link: CVE-2026-98786

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98786 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T19:15:14Z

Weaknesses