Description
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions

allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both
use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT
is compiled out in production builds, so a NULL stream->sink causes a
NULL pointer dereference.

link_set_dpms_off() already guards two earlier accesses to stream->sink
with explicit NULL checks, confirming that stream->sink can legitimately
be NULL. The subsequent call to deallocate_usb4_bandwidth() had no
equivalent guard.

Replace the ASSERT() calls with proper NULL checks that return false
early, and add a matching stream->sink guard at the call site in
link_set_dpms_off() consistent with the surrounding pattern.

v2: Keep the existing ASSERT() calls for diagnostics (to report
unexpected NULL sink), and add explicit NULL checks that return false
before dereferencing stream->sink. Also add a matching stream->sink
guard at the deallocation call site in link_set_dpms_off(). (Alex)

(cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability causes a null pointer dereference in the Linux kernel's AMD DRM subsystem when a stream’s sink is NULL. This leads to an unexpected crash of the kernel, which can result in a denial of service on the host system. The weakness is a classic NULL pointer dereference (CWE-476), exposing a flaw in input validation and null‑check handling.

Affected Systems

The affected product is the Linux kernel. No specific kernel version range is listed in the data, so all builds that contain the legacy USB4 bandwidth functions without the new null checks are potentially vulnerable.

Risk and Exploitability

The CVSS score is not available, and the EPSS score is not provided, but the vulnerability remains unlisted in CISA's KEV catalog. Because the flaw resides in kernel code, exploitation requires local execution or a scenario that induces a NULL sink during stream operations. The risk is high for any system that runs affected kernel variants, as an attacker could trigger the crash to cause a denial of service. No known public exploits exist at this time, but the lack of mitigation in production builds makes it a critical local issue.

Generated by OpenCVE AI on October 28, 2026 at 12:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Linux kernel patch that removes the NULL dereference (see commit 98029a0ce61feb52c563f65349dd9b25f672e355) or upgrade to a kernel version that includes the fix.
  • Reboot the system to load the updated kernel image.
  • Verify that the display subsystem operates normally and monitor vendor advisories for further updates.

Generated by OpenCVE AI on October 28, 2026 at 12:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT is compiled out in production builds, so a NULL stream->sink causes a NULL pointer dereference. link_set_dpms_off() already guards two earlier accesses to stream->sink with explicit NULL checks, confirming that stream->sink can legitimately be NULL. The subsequent call to deallocate_usb4_bandwidth() had no equivalent guard. Replace the ASSERT() calls with proper NULL checks that return false early, and add a matching stream->sink guard at the call site in link_set_dpms_off() consistent with the surrounding pattern. v2: Keep the existing ASSERT() calls for diagnostics (to report unexpected NULL sink), and add explicit NULL checks that return false before dereferencing stream->sink. Also add a matching stream->sink guard at the deallocation call site in link_set_dpms_off(). (Alex) (cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)
Title drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:35:06.866Z

Reserved: 2026-09-25T10:25:14.396Z

Link: CVE-2026-99151

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:35.207

Modified: 2026-10-28T11:17:35.207

Link: CVE-2026-99151

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:15:14Z

Weaknesses