CVE-2026-43477: drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/vrr: Configure VRR timings after enabling TRANSDDIFUNCCTL
Apparently ICL may hang with an MCE if we write TRANSVRRVMAX/FLIPLINE before enabling TRANSDDIFUNCCTL.
Personally I was only able to reproduce a hang (on an Dell XPS 7390 2-in-1) with an external display connected via a dock using a dodgy type-C cable that made the link training fail. After the failed link training the machine would hang. TGL seemed immune to the problem for whatever reason.
BSpec does tell us to configure VRR after enabling TRANSDDIFUNCCTL as well. The DMC firmware also does the VRR restore in two stages: - first stage seems to be unconditional and includes TRANSVRRCTL and a few other VRR registers, among other things - second stage is conditional on the DDI being enabled, and includes TRANSDDIFUNCCTL and TRANSVRRVMAX/VMIN/FLIPLINE, among other things
So let's reorder the steps to match to avoid the hang, and toss in an extra WARN to make sure we don't screw this up later.
BSpec: 22243 (cherry picked from commit 93f3a267c3dd4d811b224bb9e179a10d81456a74)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43477?
The severity of CVE-2026-43477 is rated at risk 37.
How do I fix CVE-2026-43477?
To fix CVE-2026-43477, ensure that TRANS_DDI_FUNC_CTL is enabled before writing to TRANS_VRR_VMAX/FLIPLINE.
Which software is affected by CVE-2026-43477?
CVE-2026-43477 affects the Linux kernel specifically in the drm/i915 module.
What could happen if CVE-2026-43477 is exploited?
Exploitation of CVE-2026-43477 may cause the system to hang with a machine check exception (MCE).
When was CVE-2026-43477 published?
CVE-2026-43477 was published on May 13, 2026.