Linux kernel amdgpu DM: CRTC reset leaves a dangling state pointer when allocation fails
Impact
amdgpu_dm_crtc_reset_state() freed the old CRTC state before allocating the replacement, and returned without updating the pointer if kzalloc() failed - leaving a pointer to freed memory that later state handling can follow. The fix reorders allocation before the free so a failed allocation leaves the old state intact. Be honest about the exposure on a GPU fleet: this is in the display-modesetting path of amdgpu, it needs local access to the DRM device, and it only triggers under allocation failure. Instinct-class and MI-series accelerators in headless datacenter nodes do not drive a CRTC, so most GPU hosts never reach this code; it matters on AMD nodes that do expose a display pipeline, such as workstation-class cards in a remote-desktop or VDI fleet.
Who can reach it
Local user holding an AMD DRM device node (/dev/dri/cardN) performing CRTC state resets, under kernel memory pressure. No remote path, and no path at all on headless nodes with no display pipeline.
What to do
Pick up the stable kernel commits linked in the record; it is a kernel package update, so drain and reboot each affected node. Low urgency for headless accelerator nodes - fold it into your next routine kernel roll rather than opening a window for it. Found by the Linux Verification Center with SVACE; no vendor advisory beyond the kernel commits.
References
Related entries
- Linux amdkfd: use-after-free race when two threads destroy the same compute queueCVE-2026-97429 · Linux kernel amdkfd (destroy_queue_cpsch)High
- Linux amdkfd: missing bounds check on the CRIU-supplied SDMA queue idCVE-2026-97497 · Linux kernel amdkfd (allocate_sdma_queue restore_sdma_id bounds check)High
- Linux drm/virtio: virtio-gpu hands guest-physical addresses to the host on Xen PV, exposing another domain's memoryCVE-2026-98156 · Linux kernel drm/virtio (virtio-gpu resource backing, DMA API on Xen PV)High
- accel/amdxdna: device buffers could be exported over dma-buf when they were never meant to beCVE-2026-98436 · Linux kernel accel/amdxdna (AMD XDNA NPU device buffer dma-buf export)High
- Linux kernel drm/xe: NULL pointer dereference racing VM close against eviction of a shared BOCVE-2026-98510 · Linux kernel drm/xe (VM close path, contested VMA vs page-table teardown)High
- Linux kernel nouveau: double-free of VMM page array when client init fails on device openCVE-2026-98515 · Linux kernel nouveau (nvif_vmm_dtor client teardown)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.