CVE-2026-74732: drm/amd/display: Check for tg ops in dce110_set_avmute
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Check for tg ops in dce110setavmute
Some older DCE timing generators do not implement istgenabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference on Southern Islands dGPUs when turning the display off over HDMI.
Check that tg and the required ops exist before waiting for frames.
(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The issue is described on systems using Southern Islands discrete GPUs with an older DCE timing generator. The triggering display path is HDMI.
What action triggers the failure?
The NULL pointer dereference can occur when the display is turned off over HDMI and the driver waits for AV mute frames. It requires a timing generator whose operations table does not implement is_tg_enabled.
Is every AMD display configuration affected?
No. The described condition is limited to older DCE timing generators that lack the required operation, and specifically identifies Southern Islands dGPUs during HDMI display shutdown.