Linux kernel amdgpu: unvalidated plane degamma LUT size allows divide-by-zero or out-of-bounds read
Impact
A local process with access to the DRM device can set the per-plane AMD_PLANE_DEGAMMA_LUT property with a malformed blob (for example a single entry). The size was never validated, so __is_lut_linear() can divide by zero and __drm_lut_to_dc_gamma() iterates MAX_COLOR_LUT_ENTRIES regardless of the real LUT length, reading out of bounds. On a GPU compute node this is a local crash or kernel memory disclosure vector, not remote. Exposure is narrow: the property only exists on kernels built with AMD_PRIVATE_COLOR, and the display path is generally not present or not reachable on headless MI-series accelerators, so most AMD datacenter fleets are unaffected. Where amdgpu display is compiled in and the DRM node is exposed to tenants, it is a node-availability risk.
Who can reach it
Local user with an open handle on the amdgpu DRM device (a container with /dev/dri passed through counts). Requires a kernel built with AMD_PRIVATE_COLOR. No remote path.
What to do
Pick up the stable kernel containing the fix (four stable commits are referenced) and reboot each affected node - a kernel change on a GPU node means draining the workloads and rebooting, so batch it with the next maintenance window unless tenants hold DRM device access. Interim mitigation: do not pass /dev/dri into untrusted containers on AMD display-enabled kernels. No fixed release version is stated in the record.
References
Related entries
- Linux kernel DRM core: race between failed drm_dev_register() and an open ioctl frees device state in useCVE-2026-89823 · Linux kernel DRM core (drm_dev_register() error path vs. in-flight ioctl)High
- Linux kernel drm/xe: flat CCS storage published as usable VRAM, corrupting allocationsCVE-2026-90047 · Linux kernel drm/xe (flat CCS offset rounding)High
- Linux kernel amdgpu: off-by-one in MST HDCP per-connector arrays sized 31 instead of 32CVE-2026-90289 · Linux kernel amdgpu display (AMDGPU_DM_MAX_DISPLAY_COUNT, MST HDCP per-connector arrays)High
- Linux kernel amdgpu DM: CRTC reset leaves a dangling state pointer when allocation failsCVE-2026-93175 · Linux kernel amdgpu display (amdgpu_dm_crtc_reset_state)High
- Linux amdkfd: use-after-free race when two threads destroy the same compute queueCVE-2026-97429 · Linux kernel amdkfd (destroy_queue_cpsch)High
- Linux amdkfd: missing bounds check on the CRIU-supplied SDMA queue idCVE-2026-97497 · Linux kernel amdkfd (allocate_sdma_queue restore_sdma_id bounds check)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.