drm/amd/display: Fix dc_link NULL handling in HPD init (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.15 % · centile 5 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931) drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c 923 /* 924 * Analog connectors may be hot-plugged unlike other connector 925 * types that don't support HPD. Only poll analog connectors. 926 */ 927 use_polling |= 928 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id); 930 931 dc_link = amdgpu_dm_connector->dc_link; dc_link assigned here. 932 933 /* 934 * Get a base driver irq reference for hpd ints for the lifetime 935 * of dm. Note that only hpd interrupt types are registered with 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on 937 * hpd_rx isn't available. DM currently controls hpd_rx 938 * explicitly with dc_interrupt_set() 939 */ --> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here. 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; 942 /* 943 * TODO: There's a mismatch between mode_info.num_hpd 944 * and what bios reports as the # of connectors with hpd
Faiblesses (CWE)
- CWE-476 — Déréférencement de pointeur nul
Références
- https://git.kernel.org/stable/c/d772e8570f19ac05fd9b11c8af86ada98f35f0c8
- https://git.kernel.org/stable/c/0965f1e775130e325e74152d867d2e8ce865fa05
- https://git.kernel.org/stable/c/1d15503e454bf117a0d0078332d48df86a41c828
- https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff
- https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-34107
- GCVE · GCVE-0-2026-46245
Avis du CERT-FR
- CERTFR-2026-AVI-1091 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1029 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 6.19.4
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < d772e8570f19ac05fd9b11c8af86ada98f35f0c8 ; affected 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 0965f1e775130e325e74152d867d2e8ce865fa05 ; affected 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 1d15503e454bf117a0d0078332d48df86a41c828 ; affected 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < a490e4d3c9fed1e690c8de348416eea3a9f054ff ; affected 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 226a40c06a183abaeb7529a4f54d6c203bd14407 |
| Linux · Linux | affected 4.15 ; unaffected 0 < 4.15 ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.114 ≤ 6.12.* ; unaffected 6.18.57 ≤ 6.18.* ; unaffected 6.19.4 ≤ 6.19.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |