Linux kernel amdgpu display: NULL dereference when vblank is requested on a CRTC with no stream
Impact
amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream on the enable path without the NULL check the rest of the function already applies, so enabling or querying vblank through DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached panics the kernel. The record's reproducer is a VKCTS WSI run on RADV - a graphics test suite, not an inference workload. Reachability on a datacenter GPU fleet is limited: this lives in the display path, and headless accelerator SKUs with no display pipe expose no CRTC to dereference. It matters on AMD GPU hosts that do drive displays or expose a full DRM device to a tenant, where any local user with DRM access can panic the node.
Who can reach it
Local user able to issue DRM ioctls on an amdgpu device that exposes CRTCs. Not remote and not reachable on headless configurations without display pipes.
What to do
Apply the stable fix, which guards the enable path on acrtc_state->stream being non-NULL, matching the existing checks in the same function; three stable commits are listed and the record names no fixed release. Rollout is a patched kernel and a per-node reboot. On headless GPU nodes this can follow the normal kernel cadence rather than an out-of-band window.
References
Related entries
- Linux kernel amdgpu: user-supplied indirect buffer size is unbounded, corrupting ring packet fieldsCVE-2026-80576 · Linux kernel drm/amdgpu (command submission, amdgpu_cs_p2_ib IB size)Unscored
- GPU / accelerator firmware (VBIOS, GSP, NVSwitch): GPU-resident firmware sits below the host OS and is not coveredNCVD-0000-012-gpu-accelerator-firmware-vbios-g · GPU / accelerator firmware (VBIOS, GSP, NVSwitch)Unscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-001-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- NVIDIA Multi-Instance GPU (MIG) partitioning: MIG gives each instance its own SM slice, L2 slice, memory slice andNCVD-2020-003-nvidia-multi-instance-gpu-mig-pa · NVIDIA Multi-Instance GPU (MIG) partitioningUnscored
- Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA): GPUs apply data-dependent losslessNCVD-2023-003-integrated-gpu-graphics-data-com · Integrated GPU graphics data compression (Intel, AMD, Apple, Arm, Qualcomm, NVIDIA)Unscored
- NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating mode: NVIDIA GPU confidentialNCVD-2023-004-nvidia-confidential-computing-h1 · NVIDIA Confidential Computing (H100/H200/B100/B200/GB200) - CC-DevTools operating modeUnscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.