{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d772e8570f19ac05fd9b11c8af86ada98f35f0c8", "status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "versionType": "git"}, {"lessThan": "0965f1e775130e325e74152d867d2e8ce865fa05", "status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "versionType": "git"}, {"lessThan": "1d15503e454bf117a0d0078332d48df86a41c828", "status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "versionType": "git"}, {"lessThan": "a490e4d3c9fed1e690c8de348416eea3a9f054ff", "status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "versionType": "git"}, {"lessThan": "226a40c06a183abaeb7529a4f54d6c203bd14407", "status": "affected", "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.15"}, {"lessThan": "4.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92951753-508C-4AD2-8C9B-2C63E988AEA0", "versionEndExcluding": "6.19.4", "versionStartIncluding": "4.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dc_link NULL handling in HPD init\n\namdgpu_dm_hpd_init() may see connectors without a valid dc_link.\n\nThe code already checks dc_link for the polling decision, but later\nunconditionally dereferences it when setting up HPD interrupts.\n\nAssign dc_link early and skip connectors where it is NULL.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: we previously assumed 'dc_link' could be null (see line 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Analog connectors may be hot-plugged unlike other connector\n 925 * types that don't support HPD. Only poll analog connectors.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link assigned here.\n\n 932\n 933 /*\n 934 * Get a base driver irq reference for hpd ints for the lifetime\n 935 * of dm. Note that only hpd interrupt types are registered with\n 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on\n 937 * hpd_rx isn't available. DM currently controls hpd_rx\n 938 * explicitly with dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * TODO: There's a mismatch between mode_info.num_hpd\n 944 * and what bios reports as the # of connectors with hpd"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Correcci\u00f3n del manejo de dc_link NULL en la inicializaci\u00f3n de HPD\n\namdgpu_dm_hpd_init() puede encontrar conectores sin un dc_link v\u00e1lido.\n\nEl c\u00f3digo ya verifica dc_link para la decisi\u00f3n de sondeo, pero luego lo desreferencia incondicionalmente al configurar las interrupciones HPD.\n\nAsigne dc_link con antelaci\u00f3n y omita los conectores donde sea NULL.\n\nSoluciona lo siguiente:\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()\nerror: previamente asumimos que 'dc_link' podr\u00eda ser nulo (ver l\u00ednea 931)\n\ndrivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c\n 923 /*\n 924 * Los conectores anal\u00f3gicos pueden ser conectados en caliente a diferencia de otros tipos de conectores\n 925 * que no soportan HPD. Solo sondee los conectores anal\u00f3gicos.\n 926 */\n 927 use_polling |=\n 928 amdgpu_dm_connector->dc_link &&\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ El parche a\u00f1ade esta verificaci\u00f3n de NULL pero ojal\u00e1 pueda ser eliminada\n\n 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);\n 930\n 931 dc_link = amdgpu_dm_connector->dc_link;\n\ndc_link asignado aqu\u00ed.\n\n 932\n 933 /*\n 934 * Obtenga una referencia de irq del controlador base para las interrupciones hpd durante la vida \u00fatil\n 935 * de dm. Tenga en cuenta que solo los tipos de interrupci\u00f3n hpd se registran con\n 936 * el controlador base; los tipos hpd_rx no lo est\u00e1n. En otras palabras, amdgpu_irq_get/put en\n 937 * hpd_rx no est\u00e1 disponible. DM actualmente controla hpd_rx\n 938 * expl\u00edcitamente con dc_interrupt_set()\n 939 */\n--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {\n ^^^^^^^^^^^^^^^^^^^^^^^ Si es NULL, entonces tenemos problemas porque lo desreferenciamos aqu\u00ed.\n\n 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;\n 942 /*\n 943 * PENDIENTE: Hay una discrepancia entre mode_info.num_hpd\n 944 * y lo que la BIOS informa como el n\u00famero de conectores con hpd"}], "id": "CVE-2026-46245", "lastModified": "2026-11-06T17:17:53.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46245", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:12:46.754116Z", "version": "2.0.3"}}]}, "published": "2026-06-03T18:16:24.637", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0965f1e775130e325e74152d867d2e8ce865fa05"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d15503e454bf117a0d0078332d48df86a41c828"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d772e8570f19ac05fd9b11c8af86ada98f35f0c8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}