Riskcovery

CVE-2026-93068

drm/amd/display: Fix DM I2C teardown race

State
Published
Severity
Not scored
Published
Sep 17, 2026
Updated
Oct 19, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix DM I2C teardown race

DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backing DM state has been torn down, leading to a NULL pointer dereference.

Create a devres group around the DM I2C adapter lifetime and release it at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn down. This removes the I2C adapters first and waits for in-flight users to drain before the structures used by amdgpu_dm_i2c_xfer() disappear.

This fixes a teardown ordering race seen during device removal:

BUG: kernel NULL pointer dereference RIP: amdgpu_dm_i2c_xfer+0x122/0x1c0 [amdgpu] Call Trace: __i2c_transfer i2c_transfer i2cdev_ioctl_rdwr

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 to before 8ee385305e8902fa6fbfd66b5a112238292567b6Affected
  • 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 to before 6970ec944567f109ac4240f9aea58158ee8a18cdAffected
  • 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 to before e4ae30a12aa95942814957d8bc1ce7366a7107d7Affected
LinuxLinux
  • 6.18Affected
  • before 6.18Not affected
  • 6.18.52 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.