CVE-2026-74732 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Check for tg ops in dce110_set_avmute
Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference on Southern Islands dGPUs when turning the display off over HDMI.
Check that tg and the required ops exist before waiting for frames.
(cherry picked from commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The vulnerability identified in the Linux kernel's DRM AMD display subsystem, specifically within the dce110_set_avmute function, represents a critical NULL pointer dereference issue affecting older Southern Islands graphics processing units. This flaw originates from an assumption that all Display Core Engine (DCE) timing generators implement the is_tg_enabled operation within their hardware operations table. In reality, certain legacy DCE implementations lack this specific method definition. When the kernel attempts to wait for AV mute frames during display state transitions, it unconditionally invokes this missing function pointer without verifying its existence in the driver's operational structure. This oversight leads directly to a memory access violation when the code tries to execute an address that is null or invalid, resulting in a system crash or kernel panic depending on the execution context and protection mechanisms active at the time of the fault.
From a technical perspective, this defect falls under CWE-476, which describes NULL Pointer Dereference vulnerabilities where software attempts to use a pointer that has not been initialized or validated for nullity before dereferencing it. The root cause lies in insufficient input validation and lack of defensive programming practices within the driver's hardware abstraction layer. By failing to check whether the timing generator object exists and whether its associated operations table contains the required function pointers, the code violates fundamental principles of safe memory access. This type of error is particularly dangerous because it can be triggered by standard user-space actions such as changing display output modes or disconnecting HDMI cables, making it a potential vector for local denial-of-service attacks if exploited in environments where kernel stability is paramount.
The operational impact of this vulnerability is primarily centered on system reliability and availability rather than data confidentiality or integrity. An attacker with local access to the machine could potentially trigger this condition by manipulating display settings through standard graphics APIs, causing the kernel to crash. This results in a complete loss of service for the affected workstation or server until it is manually rebooted. In virtualized environments or systems running critical workloads, such instability can lead to significant downtime and operational disruption. Furthermore, while direct code execution via this specific NULL pointer dereference is unlikely due to modern kernel protections like KASLR and stack canaries, the resulting denial-of-service condition remains a serious security concern for any deployment requiring high availability.
Mitigation strategies involve applying the upstream Linux kernel patch that introduces explicit checks for the presence of timing generator operations before attempting to invoke them. System administrators should ensure their systems are updated with the latest stable kernel versions containing this fix. For environments where immediate patching is not feasible, temporary workarounds might include disabling HDMI output features or avoiding specific display state transitions on affected Southern Islands hardware until a patched driver is available. Additionally, developers integrating similar drivers into custom kernels must adhere to strict validation protocols when accessing hardware operation tables, ensuring that all function pointers are verified for non-null status before execution to prevent recurrence of this class of vulnerability across other AMD GPU families or future kernel releases aligned with ATT&CK techniques related to resource exhaustion and system availability compromise.