Cloudanix VulnDB

CVE-2026-93175

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in AMD graphics handling on Linux can let a logged-in user crash the system or gain extra privileges, so update the operating system soon.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

amdgpu_dm_crtc_reset_state frees prior state then attempts kzalloc; on failure it returns without clearing the pointer, leaving a reference to already-released memory.

Why it matters to the business

Linux systems using AMD GPUs may experience kernel crashes or local privilege escalation, disrupting graphics workloads and requiring emergency patching.

How an attack unfolds

An attacker with local access triggers repeated CRTC resets while inducing kzalloc failures through memory pressure, then dereferences the dangling pointer to achieve use-after-free corruption.

How to fix it

Update the Linux kernel to a version containing the corrected amdgpu_dm_crtc_reset_state logic that allocates before freeing.

How to confirm the fix worked

Inspect the amdgpu_dm_crtc_reset_state implementation in the running kernel source; confirm the allocation precedes the free and that failure paths leave the original pointer intact.

Typical attack path

  1. Obtain local access on an affected AMD GPU system
  2. Trigger amdgpu_dm_crtc_reset_state via display mode changes
  3. Exhaust memory to force kzalloc failure
  4. Dereference the stale pointer to corrupt kernel memory

How to detect it

Review kernel logs for amdgpu or drm related oops containing reset_state or kzalloc failures; correlate with process activity that alters display modes.

What your security team should do

  • Apply the upstream fix to all AMD GPU hosts within the next patch cycle
  • Monitor kernel oops and panic logs for signs of display-state corruption
  • Restrict unprivileged local access on multi-user AMD systems until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in CRTC reset function amdgpu_dm_crtc_reset_state() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory. Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns. Found by Linux Verification Center (linuxtesting.org) with SVACE. [adjust for movement around current amd-staging-drm-next]

Affected packages

Ecosystem Package Introduced Fixed