CVE-2024-26699

What it actually does

Out-of-bounds array access in dcn35_clkmgr when iterating over the dcn35 clocks array without enforcing the declared size limit, resulting in invalid memory reads or writes in the AMD display driver.

Why it matters to the business

May cause kernel instability or crashes on systems using affected AMD graphics hardware, leading to unplanned downtime and reduced system availability; low exploit likelihood reduces immediate risk.

How an attack unfolds

An attacker with local access triggers graphics or display operations that cause the clock manager to iterate beyond the array bounds, attempting to read or write adjacent kernel memory structures.

How to fix it

Update the Linux kernel to a version containing commit ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb which adds the array size check in dcn35_clkmgr; apply the patch or upgrade to a stable kernel release that includes this fix.

How to confirm the fix worked

Confirm the presence of commit ca400d8e0c1c9d79c08dfb6b7f966e26c8cae7fb in the kernel source tree or verify that the dcn35_clkmgr iteration loop now respects the array size constant before building or deploying the kernel.

Typical attack path

1. Obtain local user access on a system with a vulnerable AMD DCN35-based GPU
2. Execute or induce display or graphics API calls that exercise the clkmgr iteration path
3. Trigger the unbounded loop to perform out-of-bounds memory access
4. Leverage resulting memory corruption for denial of service or potential privilege escalation

How to detect it

Review kernel logs for array bounds warnings or page faults originating from amd/display/dc/clk_mgr/dcn35 or dcn35_clkmgr; examine crash dumps for memory access violations in the display clock manager path.

What your security team should do

• Prioritize kernel updates on all systems with AMD DCN35 GPUs
• Monitor for new stable kernel releases containing the fix
• Test the updated kernel in a non-production environment before broad deployment
• Review graphics driver usage to identify high-risk workloads