CVE-2026-68256

What it actually does

Unconditional retain of prev_sink via dc_sink_retain at function entry followed by an early false return on the DP alt mode timeout path inside SIGNAL_TYPE_DISPLAY_PORT without a matching dc_sink_release, leaving a dangling reference while all other paths perform the release.

Why it matters to the business

On Linux systems using AMD GPUs, repeated triggering of the affected display-path condition can exhaust kernel memory references, increasing the risk of instability, crashes, or memory corruption that could be leveraged for local privilege escalation.

How an attack unfolds

An attacker with local access triggers repeated display-port alternate-mode connection or timeout events that exercise the leaking return path; the accumulated unreleased references eventually enable a use-after-free or memory-pressure primitive that can be turned into kernel code execution.

How to fix it

Update the Linux kernel to a version containing commit 45510cf662dcf46b5d8926d454f338809f107b9d (or the equivalent back-port) so that the DP alt-mode timeout path also calls dc_sink_release(prev_sink).

How to confirm the fix worked

Confirm the patched kernel source contains the dc_sink_release call on every return path of detect_link_and_local_sink; run targeted display-port attach/detach stress tests and monitor for reference-count warnings or memory leaks.

Typical attack path

1. Obtain local unprivileged access on a Linux host with an AMD GPU
2. Force repeated DP alt-mode attach/detach or signal timeout events
3. Accumulate leaked prev_sink references until memory pressure or UAF window appears
4. Use the resulting kernel memory corruption to escalate privileges or execute code

How to detect it

Review kernel logs and dmesg for repeated calls into detect_link_and_local_sink followed by missing release messages; look for reference-count imbalance warnings or slab memory growth correlated with display-port events.

What your security team should do

• Prioritize kernel updates on all AMD-GPU Linux systems within standard patch windows
• Restrict unprivileged local accounts where feasible until patches are deployed
• Monitor kernel logs for reference-count imbalance warnings after display events