CVE-2026-90035: drm/amd/display: fix division by zero in get_estimated_bw()
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: fix division by zero in getestimatedbw()
getestimatedbw() divides by link->dpiabwallocconfig.bwgranularity, which is zeroed by resetbwallocstruct() and only populated once DPTUNNELINGBWALLOCCAPCHANGED has been handled.
linkdpdpiahandlebwallocstatus(), the DPCD interrupt handler, calls getestimatedbw() whenever DPTUNNELINGESTIMATEDBWCHANGED is set, independently of whether DPTUNNELINGBWALLOCCAPCHANGED has ever fired for that link. A connected USB4/DPIA tunneling device that reports an estimated-bandwidth change before ever reporting a capability change drives a division by zero in this IRQ path.
linkdpiasendbwallocrequest() already guards the same bwgranularity division; add the identical guard here rather than introducing a new pattern.
(cherry picked from commit f2a961457c33dc34223aad5c9e8971de34a4eed3)
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the AMD display driver with a connected USB4/DPIA tunneling device are exposed when that device participates in DisplayPort tunneling bandwidth allocation.
What sequence triggers the failure?
The device must report an estimated-bandwidth change before it has reported a bandwidth-allocation capability change. In that order, the bandwidth granularity remains zero and the display driver's DPCD interrupt handler can divide by zero.