CVE-2026-80542: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank()
amdgpudmcrtcsetvblank() dereferences acrtcstate->stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it.
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpudmcrtcsetvblank+0x6b/0x4d0 [amdgpu] Call Trace: drmvblankenable drmvblankget drmcrtcgetsequenceioctl drmioctlkernel drmioctl
Reproduced by running VKCTS with WSI tests enabled on RADV.
Guard the enable path on acrtcstate->stream being non-NULL, matching the existing checks in this function.
(cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 7b1b31bf6942e6f43509b48da23f8e27269aac39
Event History
Frequently Asked Questions
What operation triggers the fault?
The fault occurs when vblank is enabled or queried through DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream has been attached to the AMDGPU display CRTC state.
Which environments have been shown to be affected?
The issue was reproduced on the Linux kernel AMDGPU display path by running VKCTS with WSI tests enabled on RADV.
How can I identify this issue in crash data?
Affected systems may report a kernel NULL pointer dereference at address 0000000000000008 with amdgpu_dm_crtc_set_vblank in the instruction pointer or call trace. The trace can include drm_vblank_enable, drm_vblank_get, and drm_crtc_get_sequence_ioctl.