CVE-2026-53135

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

State: Published
Severity: Not scored
Published: Jun 25, 2026
Updated: Jun 25, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

[Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node.

The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36.

Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data))

(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before ee9cfcf77a8e8af637396dc00966df5f701e661cAffected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before b781f90a9528555c709e59789550893581ef0be4Affected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before a2de1d71891a038a9346b2c1a72b88c8350f2479Affected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before 7fc4fab4acc307ad2903312c195872b2953d32c3Affected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before 7ae95c0275c330b5dbae806f8e431720edad776fAffected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before bb6f705b73b5f191f14ad004e2c8c4b615806187Affected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before c90954cdea4d6998ec345de0d840d030c145b89eAffected c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before adf67034b1f61f7119295208085bfd43f85f56afAffected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.94 through 6.12.Not affected 6.18.36 through 6.18.Not affected 7.0.13 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before ee9cfcf77a8e8af637396dc00966df5f701e661cAffected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before b781f90a9528555c709e59789550893581ef0be4Affected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before a2de1d71891a038a9346b2c1a72b88c8350f2479Affected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before 7fc4fab4acc307ad2903312c195872b2953d32c3Affected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before 7ae95c0275c330b5dbae806f8e431720edad776fAffected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before bb6f705b73b5f191f14ad004e2c8c4b615806187Affected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before c90954cdea4d6998ec345de0d840d030c145b89eAffected
c7ba3653e9773256b2b08508a2ed2ca28ea7566b to before adf67034b1f61f7119295208085bfd43f85f56afAffected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.94 through 6.12.*Not affected
6.18.36 through 6.18.*Not affected
7.0.13 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.