Bug 2536766 (CVE-2026-93175)

Summary:	CVE-2026-93175 kernel: drm/amd/display: Fix dangling pointer in CRTC reset function
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's display driver for AMD graphics, specifically within the `drm/amd/display` component. This vulnerability occurs in the `amdgpu_dm_crtc_reset_state()` function when it attempts to reset the display state. If a memory allocation fails during this process, the system can be left with a pointer to memory that has already been released, known as a dangling pointer. An attacker with local access could potentially exploit this to cause the system to crash or gain elevated privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 19:29:30 UTC

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix dangling pointer in CRTC reset function

amdgpu_dm_crtc_reset_state() frees the old state before allocating
a new one. If kzalloc() fails, the function returns without updating
the state pointer, leaving a dangling pointer to already freed memory.

Fix this by allocating the new state first. On allocation failure, the
old state remains untouched and the function safely returns.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

[adjust for movement around current amd-staging-drm-next]

Comment 1 gkamathe 2026-09-18 05:50:14 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93175.mbox