Cloudanix VulnDB

CVE-2026-68235

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain AMD graphics chips can crash the whole computer when two monitors are connected through a DisplayPort cable chain.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Null pointer dereference in dce100_find_first_free_match_stream_enc_for_link() when a DP MST stream falls back to an analog DAC encoder lacking dp_set_stream_attribute on DCE8 ASICs, leading to kernel oops in link_set_dpms_on() during atomic commit.

Why it matters to the business

Kernel panic and system crash on affected AMD GPUs when connecting multiple monitors via DisplayPort MST daisy chaining, causing denial of service and potential data loss or downtime for users relying on multi-monitor setups.

How an attack unfolds

An attacker with local access configures multiple DP MST displays on a vulnerable DCE8 GPU (such as Bonaire), triggering the fallback logic that assigns the analog encoder; the subsequent atomic commit dereferences missing function pointers and crashes the kernel.

How to fix it

Update to a patched Linux kernel containing the fix for drm/amd/display dce100 MST encoder selection; apply the change that uses dc_is_dp_signal() to skip encoders without dp_set_stream_attribute for DP streams.

How to confirm the fix worked

Verify kernel version includes commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8 or equivalent; test DP MST hotplug and dual-monitor boot scenarios on DCE8 hardware to confirm stability; inspect dce100 resource pool assignment code for the signal-type check.

Typical attack path

  1. Obtain local access to a system with a DCE8-class AMD GPU
  2. Connect or hotplug a second DisplayPort monitor in an MST daisy chain
  3. Trigger display reconfiguration or atomic commit via userspace graphics stack
  4. Trigger fallback to analog encoder lacking DP hooks
  5. Cause kernel NULL dereference and crash

How to detect it

Search kernel logs and dmesg for oops/panic messages containing drm/amd/display, dce100_find_first_free_match_stream_enc_for_link, link_set_dpms_on, or NULL function pointer dereferences during DP MST atomic commits; correlate with hotplug events on affected hardware.

  • dce100_find_first_free_match_stream_enc_for_link
  • link_set_dpms_on
  • dc_is_dp_signal
  • Bonaire.*DP MST
  • kernel oops.*drm/amd/display

What your security team should do

  • Prioritize kernel updates on systems with AMD DCE8 GPUs using DP MST
  • Monitor kernel logs for drm/amd oops entries during display hotplug
  • Restrict local user access to display configuration utilities until patched
  • Test multi-monitor setups in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: dce100: skip non-DP stream encoders for DP MST On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital DIG stream encoders plus one analog DAC encoder. When assigning a stream encoder for a second DisplayPort MST stream, if the preferred digital encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link() falls back to the first free pool entry. That entry may be the analog encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute. The subsequent atomic commit then dereferences NULL function pointers in link_set_dpms_on() and crashes. Skip encoders without dp_set_stream_attribute when the stream uses a DP signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST fallback path instead of checking only the link connector signal. Tested on: - GPU: AMD Radeon R7 260X (Bonaire / DCE8) - Board: Supermicro C9X299-PG300 - Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot - Kernel: 7.1.3 (issue observed since 6.19) - Result: kernel oops without patch; dual monitors stable with patch (cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)

Affected packages

Ecosystem Package Introduced Fixed