CVE-2026-46245

{"id": "CVE-2026-46245", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "a490e4d3c9fed1e690c8de348416eea3a9f054ff", "versionType": "git"}, {"status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "lessThan": "226a40c06a183abaeb7529a4f54d6c203bd14407", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"status": "unaffected", "version": "0", "lessThan": "4.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.19.4", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"], "defaultStatus": "affected"}]}], "published": "2026-06-03T18:16:24.637", "references": [{"url": "https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dc_link NULL handling in HPD init\n\namdgpu_dm_hpd_init() may see connectors without a valid dc_link.\n\nThe code already checks dc_link for the polling decision, but later\nunconditionally dereferences it when setting up HPD interrupts.\n\nAssign dc_link early and skip connectors where it is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: we previously assumed 'dc_link' could be null (see line 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Analog connectors may be hot-plugged unlike other connector\n 925 * types that don't support HPD. Only poll analog connectors.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link assigned here.\n\n 932\n 933 /*\n 934 * Get a base driver irq reference for hpd ints for the lifetime\n 935 * of dm. Note that only hpd interrupt types are registered with\n 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on\n 937 * hpd_rx isn't available. DM currently controls hpd_rx\n 938 * explicitly with dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * TODO: There's a mismatch between mode_info.num_hpd\n 944 * and what bios reports as the # of connectors with hpd"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Correcci\u00f3n del manejo de dc_link NULL en la inicializaci\u00f3n de HPD\n\namdgpu_dm_hpd_init() puede encontrar conectores sin un dc_link v\u00e1lido.\n\nEl c\u00f3digo ya verifica dc_link para la decisi\u00f3n de sondeo, pero luego lo desreferencia incondicionalmente al configurar las interrupciones HPD.\n\nAsigne dc_link con antelaci\u00f3n y omita los conectores donde sea NULL.\n\nSoluciona lo siguiente:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: previamente asumimos que 'dc_link' podr\u00eda ser nulo (ver l\u00ednea 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Los conectores anal\u00f3gicos pueden ser conectados en caliente a diferencia de otros tipos de conectores\n 925 * que no soportan HPD. Solo sondee los conectores anal\u00f3gicos.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ El parche a\u00f1ade esta verificaci\u00f3n de NULL pero ojal\u00e1 pueda ser eliminada\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link asignado aqu\u00ed.\n\n 932\n 933 /*\n 934 * Obtenga una referencia de irq del controlador base para las interrupciones hpd durante la vida \u00fatil\n 935 * de dm. Tenga en cuenta que solo los tipos de interrupci\u00f3n hpd se registran con\n 936 * el controlador base; los tipos hpd_rx no lo est\u00e1n. En otras palabras, amdgpu_irq_get/put en\n 937 * hpd_rx no est\u00e1 disponible. DM actualmente controla hpd_rx\n 938 * expl\u00edcitamente con dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ Si es NULL, entonces tenemos problemas porque lo desreferenciamos aqu\u00ed.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * PENDIENTE: Hay una discrepancia entre mode_info.num_hpd\n 944 * y lo que la BIOS informa como el n\u00famero de conectores con hpd"}], "lastModified": "2026-07-22T20:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92951753-508C-4AD2-8C9B-2C63E988AEA0", "versionEndExcluding": "6.19.4", "versionStartIncluding": "4.15"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}