CVE-2026-93176
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dangling pointer in plane reset function
amdgpu_dm_plane_drm_plane_reset() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory.
Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
[adjust for movement around current amd-staging-drm-next]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the AMD display subsystem of the Linux kernel represents a classic use-after-free scenario arising from improper resource management during state initialization. Specifically, within the amdgpu_dm_plane_drm_plane_reset function, the code sequence originally involved freeing the existing plane state object before attempting to allocate memory for a new one. This ordering creates a critical window where, if the subsequent dynamic memory allocation via kzalloc fails due to system pressure or fragmentation, the function returns immediately without reassigning the pointer to the newly allocated structure. Consequently, the pointer continues to reference the previously freed memory block, resulting in a dangling pointer that persists within the kernel's internal data structures for display planes.
This flaw is categorized under CWE-416, which describes Use After Free vulnerabilities. The technical impact of this defect manifests when subsequent operations attempt to access or modify the plane state using the stale pointer. Since the memory has already been released back to the allocator, it may have been reallocated for other purposes by different kernel subsystems. Accessing this memory can lead to undefined behavior, including data corruption, privilege escalation if an attacker can control the contents of the freed slab, or a system crash leading to denial of service through a kernel panic. The severity is compounded by the fact that display plane resets are triggered during various graphics operations, increasing the likelihood of exploitation under specific load conditions or timing scenarios.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability could potentially be leveraged for Local Privilege Escalation if an attacker can trigger the allocation failure and then manipulate the freed memory contents to achieve arbitrary code execution upon dereference. It also falls under Improper Resource Shutdown or Release (CWE-459) in terms of lifecycle management errors, although the primary classification remains use-after-free due to the pointer retention after deallocation. The root cause is a logical error in the initialization sequence where cleanup precedes creation without adequate failure handling for the creation step itself.
Mitigation strategies primarily involve applying the upstream kernel patch that corrects this allocation order by ensuring the new state is allocated before the old one is freed. This ensures that if kzalloc fails, the original valid pointer remains intact and points to a still-valid memory region, allowing the function to return safely without introducing dangling references. System administrators should ensure their Linux kernels are updated with the latest stable releases or backported patches from AMD-staging-drm-next branches where this fix is included. Additionally, enabling kernel hardening features such as SLUB debug mode can help detect such use-after-free conditions during development and testing phases by poisoning freed memory regions to cause immediate faults rather than silent corruption.