Cloudanix VulnDB

CVE-2026-93068

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in how certain graphics hardware shuts down on Linux systems can cause the whole computer to crash.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition allows userspace I2C transfers to invoke amdgpu_dm_i2c_xfer after DM state has been torn down, resulting in NULL pointer dereference and kernel panic.

Why it matters to the business

Unexpected system crashes on Linux machines using AMD graphics hardware during device removal or driver unload, leading to downtime and potential data loss on affected workstations and servers.

How an attack unfolds

An attacker with local access or a process performing I2C operations triggers concurrent access to a DM I2C adapter while dm_hw_fini begins teardown; the transfer proceeds after backing structures are freed, dereferencing NULL in amdgpu_dm_i2c_xfer.

How to fix it

Update to a Linux kernel containing the devres-group fix that removes I2C adapters before HPD, IRQ, and DM state teardown; rebuild and reboot with the patched kernel on affected AMD GPU systems.

How to confirm the fix worked

Confirm kernel version includes the dm_hw_fini I2C devres change; attempt device removal under concurrent I2C load and verify absence of NULL dereference in amdgpu_dm_i2c_xfer; review dmesg for resolved BUG reports.

Typical attack path

  1. Obtain local access or run a process that opens an I2C device node exposed by amdgpu
  2. Initiate an I2C transfer via i2cdev_ioctl_rdwr while simultaneously triggering driver unload or device removal
  3. Race window allows transfer to enter amdgpu_dm_i2c_xfer after DM state is released
  4. NULL dereference occurs, crashing the kernel

How to detect it

Search kernel logs for BUG: kernel NULL pointer dereference with RIP pointing to amdgpu_dm_i2c_xfer; correlate with device removal events and i2c_transfer call traces; examine crash dumps for amdgpu module involvement during dm_hw_fini.

What your security team should do

  • Prioritize kernel upgrade on all AMD GPU Linux hosts within standard patch windows
  • Monitor for kernel oops involving amdgpu_dm_i2c_xfer during maintenance or hot-unplug events
  • Restrict unprivileged I2C device access via udev rules until patched kernels are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backing DM state has been torn down, leading to a NULL pointer dereference. Create a devres group around the DM I2C adapter lifetime and release it at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn down. This removes the I2C adapters first and waits for in-flight users to drain before the structures used by amdgpu_dm_i2c_xfer() disappear. This fixes a teardown ordering race seen during device removal: BUG: kernel NULL pointer dereference RIP: amdgpu_dm_i2c_xfer+0x122/0x1c0 [amdgpu] Call Trace: __i2c_transfer i2c_transfer i2cdev_ioctl_rdwr

Affected packages

Ecosystem Package Introduced Fixed