UBUNTU-CVE-2026-53313: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid NULL dereference in dcdmubsrv error paths In dcdmubsrvlogdiagnosticdata() and dcdmubsrvenabledpiatrace(). Both functions check: if (!dcdmubsrv || !dcdmubsrv->dmub) and then call DCLOGERROR() inside that block. DCLOGERROR() uses dcdmubsrv->ctx internally. So if dcdmubsrv is NULL, the logging itself can dereference a NULL pointer and cause a crash. Fix this by splitting the checks. First check if dcdmubsrv is NULL and return immediately. Then check dcdmubsrv->dmub and log the error only when dcdmubsrv is valid. Fixes the below: ../display/dc/dcdmubsrv.c:962 dcdmubsrvlogdiagnosticdata() error: we previously assumed 'dcdmubsrv' could be null (see line 961) ../display/dc/dcdmubsrv.c:1167 dcdmubsrvenabledpiatrace() error: we previously assumed 'dcdmubsrv' could be null (see line 1166)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1011.11~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1~24.04.3 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-28.28 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1003.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2016.16 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1008.8 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-28.28.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
What is the impact if exploitation succeeds?
The reported impact is denial of service through a crash caused by a NULL-pointer dereference. No confidentiality or integrity impact is indicated.
Which Ubuntu kernel packages are listed as affected?
The listed packages are linux, linux-aws, linux-azure, linux-azure-fde, linux-gcp, linux-gke, linux-realtime, and linux-riscv.
Which code paths contain the faulty error handling?
The issue is in dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace() in the AMD display driver. Their error logging can dereference dc_dmub_srv when that pointer is NULL.