Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2026-46245

Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
03/06/2026
Última modificación:
03/06/2026

Descripción

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Fix dc_link NULL handling in HPD init<br /> <br /> amdgpu_dm_hpd_init() may see connectors without a valid dc_link.<br /> <br /> The code already checks dc_link for the polling decision, but later<br /> unconditionally dereferences it when setting up HPD interrupts.<br /> <br /> Assign dc_link early and skip connectors where it is NULL.<br /> <br /> Fixes the below:<br /> drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()<br /> error: we previously assumed &amp;#39;dc_link&amp;#39; could be null (see line 931)<br /> <br /> drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c<br /> 923 /*<br /> 924 * Analog connectors may be hot-plugged unlike other connector<br /> 925 * types that don&amp;#39;t support HPD. Only poll analog connectors.<br /> 926 */<br /> 927 use_polling |=<br /> 928 amdgpu_dm_connector-&gt;dc_link &amp;&amp;<br /> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed<br /> <br /> 929 dc_connector_supports_analog(amdgpu_dm_connector-&gt;dc_link-&gt;link_id.id);<br /> 930<br /> 931 dc_link = amdgpu_dm_connector-&gt;dc_link;<br /> <br /> dc_link assigned here.<br /> <br /> 932<br /> 933 /*<br /> 934 * Get a base driver irq reference for hpd ints for the lifetime<br /> 935 * of dm. Note that only hpd interrupt types are registered with<br /> 936 * base driver; hpd_rx types aren&amp;#39;t. IOW, amdgpu_irq_get/put on<br /> 937 * hpd_rx isn&amp;#39;t available. DM currently controls hpd_rx<br /> 938 * explicitly with dc_interrupt_set()<br /> 939 */<br /> --&gt; 940 if (dc_link-&gt;irq_source_hpd != DC_IRQ_SOURCE_INVALID) {<br /> ^^^^^^^^^^^^^^^^^^^^^^^ If it&amp;#39;s NULL then we are trouble because we dereference it here.<br /> <br /> 941 irq_type = dc_link-&gt;irq_source_hpd - DC_IRQ_SOURCE_HPD1;<br /> 942 /*<br /> 943 * TODO: There&amp;#39;s a mismatch between mode_info.num_hpd<br /> 944 * and what bios reports as the # of connectors with hpd

Impacto