CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

CVE-2026-74449: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport

If a plane reaches calculate_mcache_setting with a zero-area viewport,
calculate_mcache_setting exits early with num_mcaches == 0 and
mvmpg_width/height == 0. This will cause a divide-by-zero panic and can
also cause an underflow on num_mcaches.

Fix this by changing calculate_mcache_setting to bool and adding guards
after each calculate_mcache_row_bytes call. If num_mcaches or
mvmpg_width/height is zero, return a false. Callers will propagate the
failure as a rejected mode, which prevents the panic.

(cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)

The Linux kernel CVE team has assigned CVE-2026-74449 to this issue.


Affected and fixed versions
===========================

	Fixed in 7.1.8 with commit 1f93537881fd22712732a60ad12572a3fd40c0ec
	Fixed in 7.2-rc6 with commit f327e389c07cfc3a2f6ff54f6214e1a52d457edc

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74449
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/display/dc/dml2_0/dml21/src/dml2_core/dml2_core_dcn4_calcs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1f93537881fd22712732a60ad12572a3fd40c0ec
	https://git.kernel.org/stable/c/f327e389c07cfc3a2f6ff54f6214e1a52d457edc