CVE-2026-80542: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix NULL pointer dereference in amdgpudmcrtcsetvblank()
amdgpudmcrtcsetvblank() dereferences acrtcstate->stream when vblank is enabled/queried from DRMIOCTLMODECRTCGETSEQUENCE before a stream is attached to it.
BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpudmcrtcsetvblank+0x6b/0x4d0 [amdgpu] Call Trace: drmvblankenable drmvblankget drmcrtcgetsequenceioctl drmioctlkernel drmioctl
Reproduced by running VKCTS with WSI tests enabled on RADV.
Guard the enable path on acrtcstate->stream being non-NULL, matching the existing checks in this function.
(cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix for amdgpu_dm_crtc_set_vblank() to guard the enable path and ensure acrtc_state->stream is non-NULL before it is dereferenced (drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() / drm_crtc_get_sequence_ioctl path).
Linux kernel Guard the enable path on acrtc_state->stream being non-NULL = Enable null-check so acrtc_state->stream is not NULL before dereference in amdgpu_dm_crtc_set_vblank()