UBUNTU-CVE-2026-74449: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculatemcachesetting on zero viewport If a plane reaches calculatemcachesetting with a zero-area viewport, calculatemcachesetting exits early with nummcaches == 0 and mvmpgwidth/height == 0. This will cause a divide-by-zero panic and can also cause an underflow on nummcaches. Fix this by changing calculatemcachesetting to bool and adding guards after each calculatemcacherowbytes call. If nummcaches or mvmpgwidth/height is zero, return a false. Callers will propagate the failure as a rejected mode, which prevents the panic. (cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 29c0f7c655f47bcbd575ff75e58480df6ec3c9da
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-hwe-edge, linux-azure, linux-gcp, linux-azure-fde, linux-gke, and linux-aws-5.0 kernel packages. Exploitation requires local access with low privileges.
What condition is needed to trigger the failure?
A display plane must reach the AMD display driver's calculate_mcache_setting path with a zero-area viewport. This can lead to a divide-by-zero kernel panic and an underflow involving num_mcaches.
What happens after the fix is applied?
Zero values for the relevant cache count or viewport dimensions cause the calculation to fail. The calling code rejects the display mode instead of allowing the kernel panic.