CVE-2026-98786
Received Received - Intake

Null Pointer Dereference in Linux Kernel AMD Display Driver

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dc_sink dereferences in MST mode validation dm_dp_mst_is_port_support_mode() reads aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check, and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL check. dc_sink is cleared asynchronously on MST unplug, and both functions run from paths that the driver's own comments document as racing that teardown: the connector probe worker's ->mode_valid callback and a compositor's atomic check, neither of which holds the MST manager lock that the teardown path uses. The former does have an existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in every path that clears dc_sink, so it doesn't cover this. Fail the port-support check and skip the FRL conversion path when the sink is already gone. (cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98786
EUVD
EUVD-2026-103871

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux f04d275d94e164d24516c32437c988a323018f63
Linux Linux f04d275d94e164d24516c32437c988a323018f63
Linux Linux 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves unsafe dereferencing of a pointer to a display sink structure in AMD's display driver when handling Multi-Stream Transport (MST) mode. The functions dm_dp_mst_is_port_support_mode() and get_conv_frl_bw() access fields of aconnector->dc_sink without checking if it is NULL first. Since dc_sink can be cleared asynchronously during MST unplug events, these accesses may lead to a null pointer dereference if the sink is removed while these functions are running.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD display driver (drm/amd/display) and relates to NULL pointer dereferences in MST mode validation. Detection requires checking kernel logs for crashes or errors related to AMD display drivers, particularly during MST (Multi-Stream Transport) operations. Commands like 'dmesg | grep -i amd' or 'journalctl -k | grep -i amd' may show relevant errors. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could cause system crashes or instability when using AMD graphics with MST displays. If the display is unplugged or disconnected during certain operations, the kernel may attempt to access freed memory, leading to kernel panics or unexpected behavior.

Mitigation Strategies

Immediately update your Linux kernel to a version that includes the fix for this vulnerability. Check your distribution's security advisories or kernel updates. If updating is not immediately possible, disable AMD display driver features related to MST (Multi-Stream Transport) to reduce exposure. Monitor kernel logs for signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98786. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart