CVE-2026-31461: Linux Kernel Information Disclosure

CVE-2026-31461 Overview

A memory leak vulnerability has been identified in the Linux kernel's AMD display driver (amdgpu_dm). The issue occurs when a display sink is connected and the aconnector->drm_edid pointer is overwritten without properly freeing the previous memory allocation. This results in a memory leak during system resume operations, potentially leading to resource exhaustion over time.

Critical Impact

Repeated resume cycles on systems with AMD graphics can cause progressive memory exhaustion due to leaked EDID data allocations, potentially degrading system stability and performance.

Affected Products

• Linux kernel with AMD GPU display driver (drm/amd/display)
• Systems utilizing amdgpu_dm display manager component
• AMD Radeon graphics hardware running affected kernel versions

Discovery Timeline

• 2026-04-22 - CVE CVE-2026-31461 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31461

Vulnerability Analysis

This vulnerability is classified as a Memory Leak within the Linux kernel's AMD display subsystem. The amdgpu_dm (AMDGPU Display Manager) component is responsible for managing display connections and handling EDID (Extended Display Identification Data) information for connected monitors and displays.

When a sink (display device) is connected to the system, the driver retrieves and stores the EDID information in the aconnector->drm_edid structure. The vulnerability manifests during system resume operations where this pointer is overwritten with new data without first releasing the previously allocated memory. Each resume cycle that encounters a connected display will allocate new memory for the EDID data while orphaning the previous allocation, creating a cumulative memory leak.

Root Cause

The root cause lies in improper memory management within the AMD display driver's sink connection handling code. Specifically, when updating the drm_edid field of the aconnector structure, the code failed to call the appropriate memory deallocation function on the existing allocation before assigning a new pointer value. This oversight results in the previous memory block becoming unreachable and unrecoverable by the system.

The fix involves adding a proper free operation for the previous drm_edid allocation before updating it with the new value, ensuring proper memory lifecycle management.

Attack Vector

This vulnerability is primarily a reliability and availability concern rather than a direct security exploit vector. The memory leak occurs through normal system operations (display connection during resume) and does not require attacker interaction. However, in scenarios where an attacker has local access, they could potentially trigger repeated suspend/resume cycles to accelerate memory exhaustion, leading to denial of service conditions.

The vulnerability affects systems with AMD graphics hardware running vulnerable kernel versions. Systems that frequently suspend and resume (such as laptops) are more susceptible to experiencing the cumulative effects of this memory leak.

Detection Methods for CVE-2026-31461

Indicators of Compromise

• Gradual increase in kernel memory usage (/proc/meminfo showing declining MemFree after multiple resume cycles)
• Memory allocation errors in kernel logs related to DRM or AMD display subsystem
• System slowdown or instability after extended periods of suspend/resume operations
• Kernel memory leak detection tools (kmemleak) reporting unreferenced objects in drm_edid allocations

Detection Strategies

• Monitor kernel logs (dmesg) for memory allocation failures or warnings from the drm/amd/display subsystem
• Implement kernel memory leak detection using CONFIG_DEBUG_KMEMLEAK during testing phases
• Track memory consumption patterns before and after suspend/resume cycles on systems with AMD graphics
• Use memory profiling tools to identify orphaned allocations in the display driver context

Monitoring Recommendations

• Enable kernel memory debugging features in development and testing environments
• Configure alerts for abnormal memory consumption trends on systems running AMD display drivers
• Implement automated testing of suspend/resume cycles with memory tracking enabled
• Review system memory statistics after resume operations to detect potential leak patterns

How to Mitigate CVE-2026-31461

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix (commit 52024a94e7111366141cfc5d888b2ef011f879e5)
• Apply stable kernel patches from the provided kernel.org commits
• Schedule system reboots for affected systems to reclaim leaked memory until patches can be applied
• Minimize suspend/resume cycles on production systems with AMD graphics until patched

Patch Information

The fix has been backported to stable kernel branches and is available through the following commits:

• Kernel Git Commit 37c2caa
• Kernel Git Commit 52db857
• Kernel Git Commit eb95595

The fix ensures that the previous drm_edid allocation is properly freed before updating it with a new value, eliminating the memory leak on resume operations.

Workarounds

• Avoid suspend/resume operations on systems with AMD graphics hardware until the patch is applied
• Schedule periodic system reboots to reclaim leaked memory on systems where patching is delayed
• Monitor memory usage and reboot proactively when memory consumption reaches concerning thresholds
• Consider disabling suspend functionality temporarily on critical systems if feasible

# Check current kernel version
uname -r

# View available kernel updates (Debian/Ubuntu)
apt list --upgradable | grep linux-image

# Apply kernel updates (Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f1-2)

# Verify applied patches by checking loaded module version
modinfo amdgpu | grep -i version