Riskcovery

CVE-2026-93175

drm/amd/display: Fix dangling pointer in CRTC reset function

State
Published
Severity
7.8 High
Published
Sep 17, 2026
Updated
Oct 30, 2026
Reserved
Sep 17, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix dangling pointer in CRTC reset function

amdgpu_dm_crtc_reset_state() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory.

Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

[adjust for movement around current amd-staging-drm-next]

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before 0c311d5fcfcd4e83c1aeeb4fccb04861be3357a9Affected
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before ef3293c87a79f734d506769ff86f99bf1bad522eAffected
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before 9de069b724f3614ed7dd55bfbb37c434db54e128Affected
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before 3a03827bb3cda1527aa923f18160c449f2b4cf2cAffected
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before 32bd68edbc6cbcfac0e4033b64f0bcadbf0efef5Affected
  • e7b07ceef2a650e5ed8ca37997689e086c680daf to before 0aeed866cb938943908c3ba46422128e49d2d080Affected
LinuxLinux
  • 4.15Affected
  • before 4.15Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.57 through 6.18.*Not affected
  • 7.2.6 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.