CVE-2026-89819: drm/amd/display: validate plane degamma LUT size for private color prop
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: validate plane degamma LUT size for private color prop
Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes(), the per-plane degamma LUT size was never validated before use. setdmplanedegamma() passed the user-supplied size straight into islutlinear() and, for a non-linear LUT, into setinputtf() -> drmluttodcgamma(), the latter always iterating MAXCOLORLUTENTRIES entries regardless of the actual LUT size.
A malformed AMDPLANEDEGAMMALUT blob (e.g. a single entry) could thus trigger a divide-by-zero in islutlinear() or an out-of-bounds read in drmluttodcgamma(). Reject any plane degamma LUT whose size does not match MAXCOLORLUTENTRIES, mirroring the invariant the code already asserts a few lines below (and which the CRTC path enforces).
The AMDPLANEDEGAMMALUT property is only exposed on builds with AMDPRIVATECOLOR defined.
Event History
Frequently Asked Questions
Which systems expose the vulnerable property?
The affected AMD_PLANE_DEGAMMA_LUT property is exposed only in Linux kernel builds compiled with AMD_PRIVATE_COLOR defined. Systems without that build-time configuration do not expose this property.
What does an attacker need to trigger the issue?
An attacker needs to supply a malformed AMD_PLANE_DEGAMMA_LUT blob with a size other than MAX_COLOR_LUT_ENTRIES, such as a one-entry LUT. The unvalidated size can lead to a divide-by-zero during linearity checking or an out-of-bounds read during gamma conversion.
How can administrators determine whether the fix is present?
The resolved code rejects plane degamma LUT blobs unless their size exactly matches MAX_COLOR_LUT_ENTRIES. The referenced stable commits contain the correction.