CVE-2025-68196

What it actually does

Race condition in drm/amd/display LT automation where current_state is referenced and then clobbered by dc_update_planes_and_stream, causing a crash instead of safe iteration over cached stream pointers.

Why it matters to the business

System crashes and instability on Linux hosts using AMD graphics hardware can interrupt workloads, require reboots, and increase operational overhead; the bug affects a widely deployed kernel with many downstream dependents.

How an attack unfolds

An attacker with local access triggers repeated link-training automation updates while concurrent plane/stream state changes occur, causing the driver to dereference stale or clobbered current_state pointers and panic the kernel.

How to fix it

Upgrade the Linux kernel to 6.17.8 or apply commit 9ecd238e8230e83a5c5436fd2261da4518f5c979; for the listed Chainguard packages update to 2.5.0-r1.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is at least version 6.17.8; inspect dmesg or journalctl for absence of the prior crash signature after applying the update.

Typical attack path

1. Obtain local execution on an affected Linux system with AMD display hardware
2. Trigger or manipulate display link-training automation events
3. Induce concurrent dc_update_planes_and_stream calls that modify current_state
4. Driver dereferences invalid stream pointers and crashes

How to detect it

Search kernel logs (dmesg, journalctl) for panic or oops messages originating from drm/amd/display LT automation or dc_update_planes_and_stream; correlate with display hot-plug or link-training events.

What your security team should do

• Apply the kernel update to 6.17.8 (or equivalent fixed commit) on all AMD-based systems as the highest priority
• Reboot affected hosts after patching to activate the cached-stream change
• Monitor kernel logs for drm/amd/display panics until patching is complete across the fleet