SB20261022395 - NULL pointer dereference in Linux kernel display amdgpu_dm driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98785)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering a kernel crash during GPU reset recovery.

The vulnerability exists due to a NULL pointer dereference in the Linux kernel AMD display driver when resuming after a failed display-state allocation during suspend. A local user can potentially trigger GPU reset recovery under allocation-failure conditions to cause dm_resume() to dereference a NULL cached_dc_state and crash the kernel.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/015e72cde567d2450e282c2790773463156b2d0a
• https://git.kernel.org/stable/c/197946faa1b7968046ba475ae2f266847c6f51ed
• https://git.kernel.org/stable/c/29302964ef583f3a57efc3c990bc0a71337bd3a4
• https://git.kernel.org/stable/c/686baa1f4ec43b33e39e3d4b4a4539a91d17e883
• https://git.kernel.org/stable/c/7283b78ca07ce491984a63f6288f3f8de5bdcb22