GPU VulnDB

Database/NVIDIA / GPU stack

Linux kernel amdgpu display: NULL dereference when vblank is requested on a CRTC with no stream

UnscoredCVE-2026-80542NVIDIA / GPU stackcurated

Impact

amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream on the enable path without the NULL check the rest of the function already applies, so enabling or querying vblank through DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached panics the kernel. The record's reproducer is a VKCTS WSI run on RADV - a graphics test suite, not an inference workload. Reachability on a datacenter GPU fleet is limited: this lives in the display path, and headless accelerator SKUs with no display pipe expose no CRTC to dereference. It matters on AMD GPU hosts that do drive displays or expose a full DRM device to a tenant, where any local user with DRM access can panic the node.

Who can reach it

Local user able to issue DRM ioctls on an amdgpu device that exposes CRTCs. Not remote and not reachable on headless configurations without display pipes.

What to do

Apply the stable fix, which guards the enable path on acrtc_state->stream being non-NULL, matching the existing checks in the same function; three stable commits are listed and the record names no fixed release. Rollout is a patched kernel and a per-node reboot. On headless GPU nodes this can follow the normal kernel cadence rather than an out-of-band window.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80542https://git.kernel.org/stable/c/4a6bc92fac30070511d66bcce4ed9b7dac983180https://git.kernel.org/stable/c/5045fb4c70bfde36a05e0f41cf35ddfb6d85d3afhttps://git.kernel.org/stable/c/f2a1c4c6fe0a6fcde02e59dde546dba28d283635

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.