CVE-2024-26914

What it actually does

The vulnerability is an array overflow in the mpc_combine array within the AMD display driver, caused by using MAX_SURFACES (per stream) instead of MAX_PLANES (per ASIC) as the array size, leading to out-of-bounds writes when more than three planes are used.

Why it matters to the business

This flaw can cause system instability, crashes, or potential memory corruption in systems using AMD GPUs with the Linux kernel display driver, affecting graphics performance and reliability across affected deployments.

How an attack unfolds

An attacker with the ability to manipulate display plane configurations in the kernel could trigger the array overflow by exceeding the incorrect size limit, potentially leading to arbitrary code execution or denial of service on AMD-based systems.

How to fix it

Update the Linux kernel to include commit 0bd8ef618a42d7e6ea3f701065264e15678025e3 which corrects the mpc_combine array size to use MAX_PLANES.

How to confirm the fix worked

Verify the presence of the fix by checking the kernel source for the use of MAX_PLANES in mpc_combine array declaration or confirm the kernel includes the referenced commit.

Typical attack path

1. Identify a system with AMD display hardware running an affected kernel
2. Craft or trigger display configurations exceeding three planes per ASIC
3. Access the mpc_combine array in the display driver code path
4. Exploit the resulting buffer overflow for memory corruption or crash

How to detect it

Examine kernel logs for signs of display driver crashes, oops messages, or memory errors involving mpc_combine or plane handling; review AMD display traces for unusual plane counts.

What your security team should do

• Prioritize kernel updates on all systems with AMD GPUs
• Test updated kernels in staging environments before broad deployment
• Monitor kernel logs for display-related stability issues post-update