CVE-2026-68436 in Linux
Summary
by MITRE • 08/12/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use kvzalloc to allocate struct dc
struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change.
dc_create() allocates it with kzalloc(). Once struct dc exceeds 4 MiB the request is rounded up to order 11 (8 MiB), which is above MAX_PAGE_ORDER, so the page allocator warns and returns NULL. dc_create() then fails, DM init fails and amdgpu probe aborts with -EINVAL:
WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 dc_create+0x38/0x660 [amdgpu]
amdgpu_dm_init+0x2d9/0x510 [amdgpu]
dm_hw_init+0x1b/0x90 [amdgpu]
amdgpu_device_init.cold+0x150d/0x1e13 [amdgpu]
amdgpu_driver_load_kms+0x19/0x80 [amdgpu]
amdgpu_pci_probe+0x1e2/0x4c0 [amdgpu]
dc_create() then returns NULL and DM init fails, which aborts the whole GPU init and makes amdgpu probe fail with -EINVAL ("hw_init of IP block <dm> failed -22"), leaving the display unusable. The subsequent amdgpu_irq_put() warnings during teardown are just fallout of unwinding a half-initialized device.
struct dc is a software-only bookkeeping structure that is never handed to hardware DMA and is only ever kept as an opaque pointer, so it does not require physically contiguous memory. Allocate it with kvzalloc() (and free it with kvfree()) so that the allocator can fall back to vmalloc() when a contiguous allocation of that size is not available, which also avoids the MAX_PAGE_ORDER warning entirely.
v2: - Rebase to amd-staging-drm-next.
(cherry picked from commit 991e0516a8072f2292681c6ae98a924ab0e32575)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described involves a critical memory allocation issue within the AMD GPU display driver component of the Linux kernel, specifically affecting the drm/amd/display subsystem. This flaw manifests when the struct dc data structure exceeds 4 MiB in size, causing allocation failures that ultimately prevent GPU display initialization. The problem stems from the historical growth of the struct dc structure through multiple inlined dc_scratch_space copies, which has pushed its memory requirements beyond the page allocator's contiguous allocation limits. When the kernel attempts to allocate this large structure using kzalloc(), it triggers a warning condition because the allocation request exceeds MAX_PAGE_ORDER, resulting in NULL return values and subsequent system failures during device initialization.
The technical implementation of this vulnerability demonstrates a classic case of improper memory management in kernel space where a software-only data structure requires contiguous physical memory allocation despite having no hardware DMA requirements. The struct dc serves purely as an opaque software bookkeeping structure with no direct hardware interaction, making the requirement for physically contiguous memory unnecessary and problematic. The allocation failure occurs during the dc_create() function execution, which is part of the AMD GPU display driver initialization sequence, specifically within the amdgpu_dm_init() function call chain. This creates a cascading failure where the initial allocation error propagates through multiple kernel subsystems including dm_hw_init(), amdgpu_device_init.cold(), and ultimately amdgpu_pci_probe(), causing the entire GPU initialization process to abort with -EINVAL error code.
The operational impact of this vulnerability is severe as it completely disables display functionality for AMD GPUs, making them unusable in systems where display drivers are essential for user interaction. The failure occurs during early boot initialization, preventing normal system operation and requiring manual intervention or kernel recompilation to resolve. The vulnerability affects systems using newer GCC compilers or modified kernel configurations that increase the size of the struct dc structure beyond the 4 MiB threshold, making it a configuration-dependent issue that can appear in otherwise stable installations. Additionally, the error handling chain produces misleading warning messages during teardown operations as the system attempts to clean up partially initialized resources, compounding the diagnostic difficulty for administrators and developers.
The solution implemented addresses this vulnerability by changing the allocation mechanism from kzalloc() to kvzalloc() for the struct dc structure, with corresponding kvfree() for deallocation. This change allows the kernel's memory allocator to automatically fall back to vmalloc() when contiguous physical memory allocation fails, which is appropriate for software-only structures that do not require DMA access. The fix aligns with security best practices by preventing denial-of-service conditions through improper resource management and ensures that display functionality remains available even when large kernel data structures approach memory allocation limits. This approach follows established kernel development patterns for handling large data structures that may exceed contiguous allocation capabilities, as recommended in various kernel documentation and security guidelines.
This vulnerability can be classified under CWE-122 (Heap-based Buffer Overflow) and CWE-770 (Allocation of Resources Without Limits or Throttling) within the Common Weakness Enumeration framework, representing improper resource management in kernel space. From an ATT&CK perspective, this issue relates to T1499.004 (Endpoint Denial of Service) where the vulnerability enables a denial-of-service condition through memory allocation failures that prevent normal system operation. The fix demonstrates proper memory management practices by ensuring that software data structures do not unnecessarily consume contiguous physical memory resources when such requirements are not technically mandated, thus reducing attack surface and improving system stability. The change also aligns with kernel security hardening principles by preventing allocation failures from causing cascading system-wide initialization failures.