Cloudanix VulnDB

CVE-2026-80704

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux graphics driver for AMD cards can crash the whole computer when the screen setup code runs too early.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference when DC_LOG_SYNC() is invoked inside get_ss_info_from_atombios() (and similarly in dce112_get_pix_clk_dividers() / dcn3_get_pix_clk_dividers()) because calc_pll_cs->ctx has not yet been initialized; the function is reached before the context pointer is set in calc_pll_max_vco_construct().

Why it matters to the business

Systems using recent AMD GPUs on Linux may experience kernel crashes or instability during display initialization, leading to boot failures or display loss that disrupt user productivity and require manual recovery.

How an attack unfolds

An attacker with local access triggers the affected display clock-source initialization path (for example by loading the amdgpu driver or changing display configuration) so that the logging macros execute before the context is populated, dereferencing a NULL pointer and causing a kernel oops or panic.

How to fix it

Apply the upstream fix that redefines DC_LOGGER to use clk_src->base.ctx->logger (cherry-pick of 6f16fcbb0c46a87e3d9685407e906573d60104b0) and boot the resulting kernel; ensure the fix is present in any distribution kernel update.

How to confirm the fix worked

Confirm the patched kernel source contains the updated DC_LOGGER definition and that dce110_clk_src_construct() / dce112_clk_src_construct() now initialize base.ctx before calling ss_info_from_atombios_create(); test by loading amdgpu on affected hardware and verifying no NULL dereference occurs.

Typical attack path

  1. Load or reload the amdgpu kernel module on an affected AMD GPU
  2. Trigger ss_info_from_atombios_create() or equivalent pix_clk_dividers path during clk_src construction
  3. Execute DC_LOG_SYNC() macro before calc_pll_max_vco_construct() runs
  4. Dereference uninitialized ctx pointer resulting in kernel fault

How to detect it

Inspect kernel logs (dmesg, journalctl) for amdgpu or DC_LOG_SYNC entries followed by NULL pointer dereference oops during module load or display configuration changes; correlate with timestamps of driver initialization.

  • get_ss_info_from_atombios
  • calc_pll_cs->ctx
  • DC_LOG_SYNC
  • dce110_clk_src_construct
  • amdgpu NULL dereference

What your security team should do

  • Prioritize kernel update containing the referenced commit for all AMD GPU systems
  • Monitor kernel logs for amdgpu-related NULL pointer dereferences during boot or display changes
  • Test the updated kernel in a staging environment before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios(). According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger. Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx (cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)

Affected packages

Ecosystem Package Introduced Fixed