CVE-2026-98786: drm/amd/display: guard dc_sink dereferences in MST mode validation
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: guard dcsink dereferences in MST mode validation
dmdpmstisportsupportmode() reads aconnector->dcsink->dsccaps... for the DSC branch-throughput check, and getconvfrlbw()'s HDMI-PCON FRL-bandwidth path reads aconnector->dcsink->edidcaps.maxfrlrate, both without a NULL check. dcsink is cleared asynchronously on MST unplug, and both functions run from paths that the driver's own comments document as racing that teardown: the connector probe worker's ->modevalid callback and a compositor's atomic check, neither of which holds the MST manager lock that the teardown path uses. The former does have an existing dscaux NULL check, but dscaux isn't reliably cleared in every path that clears dcsink, so it doesn't cover this.
Fail the port-support check and skip the FRL conversion path when the sink is already gone.
(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 7c3db8da4e039698ae198c870712428644e965c7