CVE-2026-43191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43191", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.992Z", "datePublished": "2026-05-06T11:28:00.470Z", "dateUpdated": "2026-11-06T15:32:35.877Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:15.487Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "versions": [{"version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "be43c36ac13d3a158791566c9fe60511022b7a15", "status": "affected", "versionType": "git"}, {"version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "02b033e18e08a1d0b53cf540196688c82af60a2f", "status": "affected", "versionType": "git"}, {"version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51", "status": "affected", "versionType": "git"}, {"version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "75372d75a4e23783583998ed99d5009d555850da", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be43c36ac13d3a158791566c9fe60511022b7a15"}, {"url": "https://git.kernel.org/stable/c/02b033e18e08a1d0b53cf540196688c82af60a2f"}, {"url": "https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"}, {"url": "https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"}], "title": "drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:30:34.879497Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:32:35.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:30:34.879497Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T15:30:35.817Z"}}], "cna": {"title": "drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "be43c36ac13d3a158791566c9fe60511022b7a15", "versionType": "git"}, {"status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "02b033e18e08a1d0b53cf540196688c82af60a2f", "versionType": "git"}, {"status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51", "versionType": "git"}, {"status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "lessThan": "75372d75a4e23783583998ed99d5009d555850da", "versionType": "git"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/be43c36ac13d3a158791566c9fe60511022b7a15"}, {"url": "https://git.kernel.org/stable/c/02b033e18e08a1d0b53cf540196688c82af60a2f"}, {"url": "https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"}, {"url": "https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:40:15.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43191", "state": "PUBLISHED", "dateUpdated": "2026-11-06T15:32:35.877Z", "dateReserved": "2026-05-01T14:12:55.992Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T11:28:00.470Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "be43c36ac13d3a158791566c9fe60511022b7a15", "status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "versionType": "git"}, {"lessThan": "02b033e18e08a1d0b53cf540196688c82af60a2f", "status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "versionType": "git"}, {"lessThan": "d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51", "status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "versionType": "git"}, {"lessThan": "75372d75a4e23783583998ed99d5009d555850da", "status": "affected", "version": "ec129fa356bea5411cb16833cc5dab32689ea389", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h", "drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF4885A9-B170-4EBE-9912-BA83564FBE78", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Ajustar la transici\u00f3n FSM de PHY a TX_EN-a-PLL_ON para TMDS en DCN35\n\n[Por qu\u00e9]\nUn backport del cambio realizado para DCN401 que aborda un problema donde apagamos el PLL de PHY al deshabilitar la salida TMDS, lo que provoca que el OTG se quede atascado.\n\nEl OTG atascado puede provocar un cuelgue en la capacidad del DCHVM para ACK invalidaciones cuando cree que el HUBP todav\u00eda est\u00e1 encendido pero no est\u00e1 recibiendo sincronizaci\u00f3n global.\n\nLa transici\u00f3n a PLL_ON debe ser at\u00f3mica ya que no hay garant\u00eda de que el hilo no sea expropiado o sea capaz de completarse antes de que el watchdog de IOMMU agote el tiempo.\n\n[C\u00f3mo]\nRealizar un backport de la implementaci\u00f3n de dcn401 a dcn35.\n\nHay una diferencia funcional en cu\u00e1ndo se deshabilita la salida eDP en el c\u00f3digo de dcn401, por lo que no queremos utilizarlo directamente."}], "id": "CVE-2026-43191", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43191", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T15:30:34.879497Z", "version": "2.0.3"}}]}, "published": "2026-05-06T12:16:37.970", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02b033e18e08a1d0b53cf540196688c82af60a2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be43c36ac13d3a158791566c9fe60511022b7a15"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35", "id": "2467111", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467111"}, "csaw": false, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's AMD display (drm/amd/display) component. An issue occurs when the physical layer's finite state machine (PHY FSM) incorrectly transitions during the disabling of Transition Minimized Differential Signaling (TMDS) output on DCN35 hardware. This can cause the Output Timing Generator (OTG) to become stuck, leading to a system hang and a denial of service."], "name": "CVE-2026-43191", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43191\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43191\nhttps://lore.kernel.org/linux-cve-announce/2026050642-CVE-2026-43191-8efb@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,75372d75a4e23783583998ed99d5009d555850da)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T14:15:05.983114+00:00", "updated": "2026-05-11T23:15:09.787268+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}