CVE-2026-53285: drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Wrap DCN32 phantom-plane allocation in DCRUNWITHPREEMPTIONENABLED
[Why] dcn32validatebandwidth() wraps dcn32internalvalidatebw() with DCFPSTART()/DCFPEND(). In x86 non-RT, DCFPSTART takes fpregslock(), which disables local softirqs.
The DML1 path through dcn32enablephantomplane() calls kvzalloc() to allocate ~335 KiB for dcplanestate. This triggers the vmalloc path, which calls BUGON(ininterrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash.
[How] Wrap the dcstatecreatephantomplane() call with the DCRUNWITHPREEMPTIONENABLED() macro to allow preemption during this memory allocation.
(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are realistically exposed to the crash?
Systems using the AMD display driver’s DCN32 path on x86 non-real-time kernels are the relevant exposure group. The described crash occurs when phantom-plane allocation reaches the vmalloc path while local softirqs are disabled in an FPU-enabled region.
What level of access is required to exploit this issue?
An attacker needs local access and low privileges; no user interaction is required. The CVSS vector indicates the impact is limited to availability, resulting in a kernel crash rather than confidentiality or integrity loss.
What should be done to remediate the issue?
Apply a kernel update containing the available patch. The fix runs phantom-plane state allocation with preemption enabled, preventing the allocation from occurring in the problematic softirq-disabled context.