Bug 2493733 (CVE-2026-53313) - CVE-2026-53313 kernel: drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
Summary: CVE-2026-53313 kernel: drm/amd/display: Avoid NULL dereference in dc_dmub_srv...
Keywords:
Status: NEW
Alias: CVE-2026-53313
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-26 21:03 UTC by OSIDB Bzimport
Modified: 2026-06-29 09:32 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-26 21:03:55 UTC
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

In dc_dmub_srv_log_diagnostic_data() and
dc_dmub_srv_enable_dpia_trace().

Both functions check:

  if (!dc_dmub_srv || !dc_dmub_srv->dmub)

and then call DC_LOG_ERROR() inside that block.

DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if
dc_dmub_srv is NULL, the logging itself can dereference a
NULL pointer and cause a crash.

Fix this by splitting the checks.

First check if dc_dmub_srv is NULL and return immediately.
Then check dc_dmub_srv->dmub and log the error only when
dc_dmub_srv is valid.

Fixes the below:
../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961)
../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166)

Comment 1 Mauro Matteo Cascella 2026-06-29 09:25:42 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062621-CVE-2026-53313-4106@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.