From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 239EA3D88E4 for ; Wed, 3 Jun 2026 15:51:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780501882; cv=none; b=TARuLirHYZ7l2bJBzQhn+1WxKb+iQiu7W8S7He2knhFFb95SmsYNFNtOlUcH8pE6pY8gmmyJZhJRyqIuSU9OUo4AVMynXr6EzY7Tom0g4uZfkFrK60v1aYs7bUFnrjVi9ewEU7maaqTDVojurEJbxbWp1hyu03bJKnl86dytWfc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780501882; c=relaxed/simple; bh=yFjxSsXlp1fH9ahoDX51ttZQggVi9Dw5BheFxN/fncM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cXYf/t+pkXc9WWSkWNZZj1CQqQ2xjpa0BQFiQXJVRAJN4fKOi3PfOcS336Jie4SSAHu+5Q3EGSm0XHsOT0Oa++OXp/FrK7smQTifXnGBoCG7ioiQ/h714Z4ow66J3MyuMYRffUZgB42mBVgtywjrWvItNalBlB6Ncl2e4PrqM6U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Na1DeTRX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Na1DeTRX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A17D1F00893; Wed, 3 Jun 2026 15:51:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780501880; bh=dlRwAjmepqxk0BOx14nE8MLgCo3phzjBxJInepKsFcM=; h=From:To:Cc:Subject:Date:Reply-To; b=Na1DeTRXUygbJsRkomhIPCq6MAPTel8cz8XzJt3iejAMHWiKrjj3y0f3JjJ17ktJb 2GovTkjpY/dv12Pl6AFvdZPM6HZMXl91WG7h+GyNhBrTCdcQ8gxy3HPWfcZRYTcdH3 SAA2t6FFZCyqE+cxxukAtmXxG/x9MxfuooMrMSbk= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46245: drm/amd/display: Fix dc_link NULL handling in HPD init Date: Wed, 3 Jun 2026 17:49:34 +0200 Message-ID: <2026060333-CVE-2026-46245-e1e8@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3952; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=/9GSzuDHRM6VhKboFdGChqZfIwv9RCFkQdw8dZ/0rs0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkKvryfxVzZHK16qmzWbrDt/SWUxreLR2PnF941nhM79 ep32WzqiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIm4MDAs2GWd5HNjRUXfVo0d 7H415/7cmrGrBCi6c/kio9V3PnPLbZhWlX8hpa5Q7RQA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931) drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c 923 /* 924 * Analog connectors may be hot-plugged unlike other connector 925 * types that don't support HPD. Only poll analog connectors. 926 */ 927 use_polling |= 928 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id); 930 931 dc_link = amdgpu_dm_connector->dc_link; dc_link assigned here. 932 933 /* 934 * Get a base driver irq reference for hpd ints for the lifetime 935 * of dm. Note that only hpd interrupt types are registered with 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on 937 * hpd_rx isn't available. DM currently controls hpd_rx 938 * explicitly with dc_interrupt_set() 939 */ --> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here. 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; 942 /* 943 * TODO: There's a mismatch between mode_info.num_hpd 944 * and what bios reports as the # of connectors with hpd The Linux kernel CVE team has assigned CVE-2026-46245 to this issue. Affected and fixed versions =========================== Issue introduced in 4.15 with commit 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c and fixed in 6.19.4 with commit a490e4d3c9fed1e690c8de348416eea3a9f054ff Issue introduced in 4.15 with commit 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c and fixed in 7.0 with commit 226a40c06a183abaeb7529a4f54d6c203bd14407 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46245 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407