Linux Kernel up to 7.1.5 Display ISM drm/amd/display amdgpu_dm_ism_disable deadlock

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.5. It has been declared as problematic. This affects the function amdgpu_dm_ism_disable of the file drm/amd/display of the component Display ISM. Executing a manipulation can lead to deadlock. This vulnerability is handled as CVE-2026-68364. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.5. It has been declared as problematic. This vulnerability affects the function amdgpu_dm_ism_disable of the file drm/amd/display of the component Display ISM. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix ISM dc_lock deadlock during suspend [Why] System hang observed during suspend/resume while video is playing. amdgpu_dm_ism_disable() is called under dc_lock and waits for ISM delayed work via disable_delayed_work_sync(). The work handlers themselves take dc_lock, producing an ABBA deadlock when a worker is in flight at suspend time. [How] Split the disable path into two phases with opposite locking contracts: 1. amdgpu_dm_ism_disable() -- quiesces workers, must NOT hold dc_lock. 2. amdgpu_dm_ism_force_full_power() (new) -- drives the ISM FSM back to FULL_POWER_RUNNING, must hold dc_lock.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-68364 since 07/30/2026. The exploitation appears to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 7.1.6 or 7.2-rc1 eliminates this vulnerability. Applying the patch 95776812e6b8f908563e8994d5d947b68baf68a6/3714fe242592e3699ac5e2c19d68b275a210be7d is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion