CVE-2026-43243 Overview
CVE-2026-43243 is a Linux kernel vulnerability in the AMD Display (drm/amd/display) driver. The flaw resides in the get_phyd32clk_src function for the dcn401 display controller. The function attempts to access a link encoder on a DisplayPort Inline Adapter (DPIA) link without validating the signal type. Accessing the link encoder on a DPIA link triggers a kernel crash, resulting in a denial of service condition on affected systems.
The upstream fix introduces a signal type check before the link encoder access proceeds. The kernel maintainers resolved the issue across multiple stable branches.
Critical Impact
Local users with the ability to interact with affected DPIA-connected displays can trigger a kernel crash, causing system instability or denial of service on systems using AMD dcn401 display hardware.
Affected Products
- Linux kernel versions containing the drm/amd/displaydcn401 driver prior to the patched commits
- Systems using AMD GPUs with dcn401 display controller hardware
- Configurations utilizing DisplayPort Inline Adapter (DPIA) links with USB4/Thunderbolt docks
Discovery Timeline
- 2026-05-06 - CVE-2026-43243 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43243
Vulnerability Analysis
The vulnerability exists in the AMD Direct Rendering Manager (DRM) display driver, specifically in the get_phyd32clk_src function for the dcn401 IP block. This function retrieves the physical D32 clock source associated with a display link. The original implementation dereferences the link encoder pointer (link_enc) without first validating the link signal type.
DPIA links route DisplayPort signals through USB4 or Thunderbolt tunnels and do not use a conventional link encoder structure. When the function is invoked on a DPIA link, the link encoder pointer is invalid or absent, causing a null pointer dereference in kernel context. This dereference triggers a kernel oops and crashes the affected subsystem.
The patch adds a signal type check that detects DPIA links before any link encoder access occurs. The fix appears in commits 23e7150afc70, 486b2909ac28, c979d8db7b0f, and e332112255af across stable branches.
Root Cause
The root cause is missing input validation on the link signal type prior to dereferencing the link encoder. The dcn401 driver assumed all incoming links carry a standard link encoder, an assumption broken by DPIA-tunneled DisplayPort connections. This represents a Null Pointer Dereference condition leading to denial of service.
Attack Vector
The issue is reachable by triggering display configuration paths on a system equipped with dcn401 hardware connected to a DPIA link. Hot-plugging a DisplayPort sink through a USB4 or Thunderbolt dock, or invoking modeset operations on such a link, can drive execution into the unguarded code path. The vulnerability is local in nature and results in a kernel crash rather than code execution. No vendor advisory specifies remote exploitability, and no public exploit is available.
Readers requiring code-level detail should consult the upstream patches linked in the Kernel Git Commit Update.
Detection Methods for CVE-2026-43243
Indicators of Compromise
- Kernel oops or panic messages referencing get_phyd32clk_src or dcn401 in dmesg and /var/log/kern.log
- Null pointer dereference traces involving drm/amd/display and link_enc access
- System crashes coinciding with DisplayPort hot-plug events on USB4 or Thunderbolt docks
Detection Strategies
- Inventory Linux hosts running kernel versions that include the dcn401 driver and verify whether the patched commits are present.
- Correlate kernel crash dumps with display subsystem activity to identify systems hitting the unpatched code path.
- Monitor build pipelines and distribution kernel changelogs for inclusion of the upstream fix commits.
Monitoring Recommendations
- Forward kernel logs to a centralized logging platform and alert on BUG:, Oops:, or RIP: entries that reference amdgpu or dcn401.
- Track host availability metrics on workstations equipped with AMD GPUs and DPIA-capable docks for unexpected reboot patterns.
- Apply kernel live-patch monitoring to confirm remediation status across the fleet.
How to Mitigate CVE-2026-43243
Immediate Actions Required
- Identify all Linux systems running AMD GPUs with dcn401 hardware and verify their kernel version against the patched stable releases.
- Apply the latest stable Linux kernel update from your distribution that incorporates the fix commits.
- Reboot affected systems after kernel installation to ensure the patched module is loaded.
Patch Information
The vulnerability is resolved in upstream Linux kernel commits 23e7150afc70, 486b2909ac28, c979d8db7b0f, and e332112255af. The patch adds a signal type check in get_phyd32clk_src to skip link encoder access on DPIA links. Distribution-specific updates are available through standard package channels. Refer to the Kernel Git Commit Update for the canonical fix.
Workarounds
- Avoid using DisplayPort Inline Adapter (DPIA) links through USB4 or Thunderbolt docks on unpatched systems with dcn401 hardware.
- Use direct DisplayPort or HDMI connections that route through the standard link encoder path until the kernel patch is deployed.
- Restrict physical access and hot-plug operations on production hosts that cannot be patched immediately.
# Verify running kernel version and check for the fix
uname -r
# On Debian/Ubuntu, update to a patched kernel
sudo apt update && sudo apt upgrade linux-image-generic
# On RHEL/Fedora
sudo dnf update kernel
# Confirm AMD display module status after reboot
lsmod | grep amdgpu
dmesg | grep -i dcn401
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
