CVEvulnerability
CVE-2026-53285
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2026-06-26
- Last modified
- 2026-10-21
- Assigner
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-617
Description
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
[Why]
dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with
DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),
which disables local softirqs.
The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to
allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,
which calls BUG_ON(in_interrupt()) because it's invoked within the
FPU-enabled (softirq disabled) region, leading to a kernel crash.
[How]
Wrap the dc_state_create_phantom_plane() call with the
DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during
this memory allocation.
(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)
Affected configurations
• linux linux kernel (>= 6.0 < 7.0.10)
• linux linux kernel 7.1
Related
Weakness · CWE (1)
- CWE-617 Reachable Assertion weakness
References
- https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6 Patch
- https://git.kernel.org/stable/c/19e82047cb68bcde55791ee20178acd431609b8d git.kernel.org
- https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6 Patch
- https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b git.kernel.org