CVE-2026-80704 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use proper context for logging
The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios().
According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger.
Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx
(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified vulnerability resides within the Linux kernel's Direct Rendering Manager subsystem, specifically affecting AMD display drivers. This issue manifests as a NULL pointer dereference triggered during the initialization sequence of clock source components for various Display Engine architectures including DCE 110, DCE 112, and DCN3. The root cause is an improper ordering of context initialization relative to logging operations within specific driver functions. When the system attempts to retrieve spread spectrum information from ATOM BIOS or calculate pixel clock dividers, it invokes helper functions that attempt to access a logger instance via a context pointer. However, at the point these logging calls are executed, the target context structure has not yet been fully initialized with valid memory references, resulting in an invalid memory access event.
From a technical perspective, this flaw is classified under CWE-476 which denotes NULL Pointer Dereference. The vulnerability arises because functions such as get_ss_info_from_atombios rely on calc_pll_cs->ctx to obtain the logger for diagnostic output via DC_LOG_SYNC macros. In the original implementation, while clk_src->base.ctx was assigned early in construction routines like dce110_clk_src_construct or dce112_clk_src_construct, the specific context used by PLL calculation structures remained uninitialized until later stages of setup, specifically within calc_pll_max_vco_construct. Consequently, any attempt to log information before this late-stage initialization results in a crash due to accessing memory at address zero or an undefined location. Similar logic errors were identified in dce112_get_pix_clk_dividers and dcn3_get_pix_clk_dividers where the same premature access pattern existed.
The operational impact of this vulnerability is primarily stability-related rather than security-exploitable for privilege escalation, although it can lead to system instability or kernel panics during display initialization sequences. If triggered, particularly on systems with AMD graphics hardware utilizing these specific driver versions, the kernel may crash when attempting to configure display outputs that require spread spectrum information or pixel clock calculations. This disrupts normal graphical operation and requires a reboot to restore functionality. While typically occurring early in the boot process or upon loading the DRM module, an attacker could potentially induce this condition by manipulating hardware states or triggering specific display configuration paths if they have local access to initiate such operations, leading to denial of service against the system's graphical capabilities.
Mitigation strategies involve applying the upstream kernel patch that corrects the context usage order. The fix ensures that logging calls utilize clk_src->base.ctx which is guaranteed to be initialized before any subsequent helper functions are invoked. This redefines DC_LOGGER to CTX->logger consistently across affected code paths, ensuring that all diagnostic outputs reference a valid, pre-initialized context structure. Administrators should update their Linux kernel packages to include this fix. For systems unable to immediately patch the kernel, disabling specific display features or using alternative graphics drivers may serve as temporary workarounds, though updating remains the only complete resolution. This issue aligns with ATT&CK technique T1499 Endpoint Denial of Service if exploited intentionally by a local user to disrupt system availability through repeated trigger attempts during initialization phases.