Cloudanix VulnDB

CVE-2026-98785

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux graphics handling for AMD cards can crash the whole computer when memory runs low during certain power or reset events.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

NULL pointer dereference in AMD display driver when dc_state_create_copy fails during dm_suspend, leaving cached_dc_state NULL and causing crash in dm_resume during link_enc_cfg_copy and stream_count access on GPU reset recovery.

Why it matters to the business

Unplanned system crashes and instability on AMD GPU systems during suspend or reset recovery, increasing downtime and requiring manual intervention for affected Linux kernels.

How an attack unfolds

An attacker with local access triggers allocation pressure or GPU reset conditions to force dc_state_create_copy to return NULL, allowing the flawed suspend path to proceed and crash the kernel on resume when the NULL state is dereferenced.

How to fix it

Apply the upstream fix that returns -ENOMEM immediately from dm_suspend on dc_state_create_copy failure; update to a kernel containing commit 84b6d7932fdd2857795a257f9f258562a3cddcab or later equivalent.

How to confirm the fix worked

Confirm kernel source contains the NULL check and early return in dm_suspend; test by simulating allocation failure during suspend/resume cycles on AMD hardware and verify no crash occurs.

Typical attack path

  1. Obtain local code execution on target Linux system with AMD display hardware
  2. Induce memory pressure or trigger GPU reset recovery path
  3. Cause dm_suspend to call dc_state_create_copy which returns NULL
  4. Observe kernel crash in dm_resume when dereferencing the NULL cached state

How to detect it

Review kernel crash logs and dmesg for NULL dereference in dm_resume or link_enc_cfg_copy during AMD GPU suspend/resume; correlate with GPU reset events in system logs.

What your security team should do

  • Prioritize kernel updates for systems with AMD GPUs within maintenance windows
  • Monitor for related stability issues in GPU reset paths
  • Review AMD display driver changes in upcoming kernel releases

The record

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend dc_state_create_copy() can return NULL on allocation failure. dm_suspend() only conditionally skips dm_gpureset_toggle_interrupts() and continues execution, returning success. dm_resume() then dereferences the NULL cached_dc_state in link_enc_cfg_copy() and the following dc_state->stream_count loop, crashing during GPU reset recovery. Return -ENOMEM immediately if the copy fails, so the caller aborts suspend instead of leaving a NULL cached state for resume. (cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab)

Affected packages

Ecosystem Package Introduced Fixed