Bug 2524493 (CVE-2026-80542) - CVE-2026-80542 kernel: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
Summary: CVE-2026-80542 kernel: drm/amd/display: Fix NULL pointer dereference in amdgp...
Keywords:
Status: NEW
Alias: CVE-2026-80542
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-26 15:01 UTC by OSIDB Bzimport
Modified: 2026-08-27 12:50 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-26 15:01:19 UTC 
In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when
vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before
a stream is attached to it.

BUG: kernel NULL pointer dereference, address: 0000000000000008
RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu]
Call Trace:
 drm_vblank_enable
 drm_vblank_get
 drm_crtc_get_sequence_ioctl
 drm_ioctl_kernel
 drm_ioctl

Reproduced by running VKCTS with WSI tests enabled on RADV.

Guard the enable path on acrtc_state->stream being non-NULL, matching
the existing checks in this function.

(cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)
Comment 1 gkamathe 2026-08-27 12:43:12 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082606-CVE-2026-80542-ede3@gregkh/T
Note You need to log in before you can comment on or make changes to this bug.