CVE-2026-98785: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend
drm/amd/display: check dcstatecreatecopy() for NULL in dmsuspend
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 84b6d7932fdd2857795a257f9f258562a3cddcab
Event History
Frequently Asked Questions
What systems are exposed to this failure?
Systems using the Linux kernel AMD display driver are exposed when GPU reset recovery invokes the affected suspend and resume path. The failure requires dc_state_create_copy() to return NULL because of an allocation failure.
What is the impact if the allocation fails during GPU reset recovery?
The suspend path can return success while leaving cached_dc_state NULL. On resume, the driver dereferences that NULL state and crashes during GPU reset recovery.
What does the fix change?
The fix makes dm_suspend() return -ENOMEM immediately when dc_state_create_copy() fails. This aborts suspend rather than allowing resume to operate with a NULL cached state.