UBUNTU-CVE-2026-89819: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpudmverifylutsizes(), the per-plane degamma LUT size was never validated before use. setdmplanedegamma() passed the user-supplied size straight into islutlinear() and, for a non-linear LUT, into setinputtf() -> drmluttodcgamma(), the latter always iterating MAXCOLORLUTENTRIES entries regardless of the actual LUT size. A malformed AMDPLANEDEGAMMALUT blob (e.g. a single entry) could thus trigger a divide-by-zero in islutlinear() or an out-of-bounds read in drmluttodcgamma(). Reject any plane degamma LUT whose size does not match MAXCOLORLUTENTRIES, mirroring the invariant the code already asserts a few lines below (and which the CRTC path enforces). The AMDPLANEDEGAMMALUT property is only exposed on builds with AMDPRIVATECOLOR defined.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Exposure requires an AMD display stack build with AMD_PRIVATE_COLOR enabled, because only those builds expose the AMD_PLANE_DEGAMMA_LUT property. The affected Ubuntu kernel package families listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What access does an attacker need to trigger the flaw?
An attacker needs local access with low privileges and must be able to supply a malformed AMD_PLANE_DEGAMMA_LUT blob through the exposed plane color property. No user interaction is required.
What can happen if the issue is exploited?
A malformed LUT size can cause a divide-by-zero during linear-LUT checking or an out-of-bounds read during gamma conversion. The reported impact includes high confidentiality, integrity, and availability effects.
Is a default configuration necessarily affected?
No. The vulnerable property is only present when the kernel is built with AMD_PRIVATE_COLOR enabled; the provided data does not establish whether that option is enabled by default in each listed Ubuntu kernel package.