CVE-2026-89819: drm/amd/display: validate plane degamma LUT size for private color prop

Published Sep 16, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: validate plane degamma LUT size for private color prop

Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes(), the per-plane degamma LUT size was never validated before use. setdmplanedegamma() passed the user-supplied size straight into islutlinear() and, for a non-linear LUT, into setinputtf() -> drmluttodcgamma(), the latter always iterating MAXCOLORLUTENTRIES entries regardless of the actual LUT size.

A malformed AMDPLANEDEGAMMALUT blob (e.g. a single entry) could thus trigger a divide-by-zero in islutlinear() or an out-of-bounds read in drmluttodcgamma(). Reject any plane degamma LUT whose size does not match MAXCOLORLUTENTRIES, mirroring the invariant the code already asserts a few lines below (and which the CRTC path enforces).

The AMDPLANEDEGAMMALUT property is only exposed on builds with AMDPRIVATECOLOR defined.

Event History

Sep 16, 2026
CVE Published
via MITRE·10:30 AM
Data Sourced
via MITRE·10:30 AM
Description

Frequently Asked Questions

1

Which systems expose the vulnerable property?

The affected AMD_PLANE_DEGAMMA_LUT property is exposed only in Linux kernel builds compiled with AMD_PRIVATE_COLOR defined. Systems without that build-time configuration do not expose this property.

2

What does an attacker need to trigger the issue?

An attacker needs to supply a malformed AMD_PLANE_DEGAMMA_LUT blob with a size other than MAX_COLOR_LUT_ENTRIES, such as a one-entry LUT. The unvalidated size can lead to a divide-by-zero during linearity checking or an out-of-bounds read during gamma conversion.

3

How can administrators determine whether the fix is present?

The resolved code rejects plane degamma LUT blobs unless their size exactly matches MAX_COLOR_LUT_ENTRIES. The referenced stable commits contain the correction.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203