CVE-2026-68436

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: use kvzalloc to allocate struct dc<br /> <br /> struct dc has grown large over time (most of it the two inlined<br /> dc_scratch_space copies) and now sits close to the page allocator&amp;#39;s 4 MiB<br /> contiguous allocation limit. Its actual size is not fixed by the source<br /> alone, it also depends on the compiler and the .config, so it can easily<br /> cross 4 MiB, e.g. with a newer GCC or a config change.<br /> <br /> dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the<br /> request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER,<br /> so the page allocator warns and returns NULL. dc_create() then fails, DM<br /> init fails and amdgpu probe aborts with -EINVAL:<br /> <br /> WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380<br /> dc_create+0x38/0x660 [amdgpu]<br /> amdgpu_dm_init+0x2d9/0x510 [amdgpu]<br /> dm_hw_init+0x1b/0x90 [amdgpu]<br /> amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]<br /> amdgpu_driver_load_kms+0x19/0x80 [amdgpu]<br /> amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]<br /> <br /> dc_create() then returns NULL and DM init fails, which aborts the whole<br /> GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block<br /> failed -22"), leaving the display unusable. The subsequent<br /> amdgpu_irq_put() warnings during teardown are just fallout of unwinding<br /> a half-initialized device.<br /> <br /> struct dc is a software-only bookkeeping structure that is never handed<br /> to hardware DMA and is only ever kept as an opaque pointer, so it does<br /> not require physically contiguous memory. Allocate it with kvzalloc()<br /> (and free it with kvfree()) so that the allocator can fall back to<br /> vmalloc() when a contiguous allocation of that size is not available,<br /> which also avoids the MAX_PAGE_ORDER warning entirely.<br /> <br /> v2:<br /> - Rebase to amd-staging-drm-next.<br /> <br /> (cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)