CVE-2026-46245
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dc_link NULL handling in HPD init
amdgpu_dm_hpd_init() may see connectors without a valid dc_link.
The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts.
Assign dc_link early and skip connectors where it is NULL.
Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931)
dc_link assigned here.
Detalles técnicos trazas, registros y código del informe original
drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c
923 /*
924 * Analog connectors may be hot-plugged unlike other connector
925 * types that don't support HPD. Only poll analog connectors.
926 */
927 use_polling |=
928 amdgpu_dm_connector->dc_link &&
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed
929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);
930
931 dc_link = amdgpu_dm_connector->dc_link;
932
933 /*
934 * Get a base driver irq reference for hpd ints for the lifetime
935 * of dm. Note that only hpd interrupt types are registered with
936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on
937 * hpd_rx isn't available. DM currently controls hpd_rx
938 * explicitly with dc_interrupt_set()
939 */
--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {
^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.
941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;
942 /*
943 * TODO: There's a mismatch between mode_info.num_hpd
944 * and what bios reports as the # of connectors with hpdCVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.14%
- Percentil entre todas las CVEs puntuadas: 3
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-476
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-46245",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"lessThan": "a490e4d3c9fed1e690c8de348416eea3a9f054ff",
"versionType": "git"
},
{
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"lessThan": "226a40c06a183abaeb7529a4f54d6c203bd14407",
"versionType": "git"
}
],
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver",
"lessThanOrEqual": "6.19.*"
},
{
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-06-03T18:16:24.637",
"references": [
{
"url": "https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dc_link NULL handling in HPD init\n\namdgpu_dm_hpd_init() may see connectors without a valid dc_link.\n\nThe code already checks dc_link for the polling decision, but later\nunconditionally dereferences it when setting up HPD interrupts.\n\nAssign dc_link early and skip connectors where it is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: we previously assumed 'dc_link' could be null (see line 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Analog connectors may be hot-plugged unlike other connector\n 925 * types that don't support HPD. Only poll analog connectors.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link assigned here.\n\n 932\n 933 /*\n 934 * Get a base driver irq reference for hpd ints for the lifetime\n 935 * of dm. Note that only hpd interrupt types are registered with\n 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on\n 937 * hpd_rx isn't available. DM currently controls hpd_rx\n 938 * explicitly with dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * TODO: There's a mismatch between mode_info.num_hpd\n 944 * and what bios reports as the # of connectors with hpd"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Corrección del manejo de dc_link NULL en la inicialización de HPD\n\namdgpu_dm_hpd_init() puede encontrar conectores sin un dc_link válido.\n\nEl código ya verifica dc_link para la decisión de sondeo, pero luego lo desreferencia incondicionalmente al configurar las interrupciones HPD.\n\nAsigne dc_link con antelación y omita los conectores donde sea NULL.\n\nSoluciona lo siguiente:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: previamente asumimos que 'dc_link' podría ser nulo (ver línea 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Los conectores analógicos pueden ser conectados en caliente a diferencia de otros tipos de conectores\n 925 * que no soportan HPD. Solo sondee los conectores analógicos.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ El parche añade esta verificación de NULL pero ojalá pueda ser eliminada\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link asignado aquí.\n\n 932\n 933 /*\n 934 * Obtenga una referencia de irq del controlador base para las interrupciones hpd durante la vida útil\n 935 * de dm. Tenga en cuenta que solo los tipos de interrupción hpd se registran con\n 936 * el controlador base; los tipos hpd_rx no lo están. En otras palabras, amdgpu_irq_get/put en\n 937 * hpd_rx no está disponible. DM actualmente controla hpd_rx\n 938 * explícitamente con dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ Si es NULL, entonces tenemos problemas porque lo desreferenciamos aquí.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * PENDIENTE: Hay una discrepancia entre mode_info.num_hpd\n 944 * y lo que la BIOS informa como el número de conectores con hpd"
}
],
"lastModified": "2026-07-22T20:10:00.127",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92951753-508C-4AD2-8C9B-2C63E988AEA0",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.15"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}