CVE-2026-43305 Overview
CVE-2026-43305 is a locking flaw in the Linux kernel's AMD GPU display driver (drm/amd/display). The defect resides in the hardware-state semantics (HWSS) fast path, where the condition used to acquire the Display Microcontroller Unit (DMUB) hardware lock differs from the condition used to release it. On AMD ASICs without Firmware-Assisted Mailbox Stutter (FAMS) support, this mismatched unlock causes the kernel to hang. The issue is tracked under CWE-667 (Improper Locking) and impacts local availability of affected Linux systems.
Critical Impact
A local, low-privileged user can trigger a kernel hang on AMD GPU systems lacking FAMS support, resulting in denial of service.
Affected Products
- Linux Kernel — drm/amd/display subsystem
- AMD ASICs without FAMS (Firmware-Assisted Mailbox Stutter) support
- Distributions shipping vulnerable kernel revisions prior to the upstream fix
Discovery Timeline
- 2026-05-08 - CVE-2026-43305 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-43305
Vulnerability Analysis
The vulnerability lives in the AMD display driver's HWSS fast path, which is used to apply display state changes efficiently. The fast path conditionally takes the DMUB hardware lock to serialize access to the display microcontroller. The lock-acquisition predicate and the lock-release predicate are not equivalent expressions. On hardware paths where the acquire predicate evaluates false but the release predicate evaluates true (or vice versa), the driver attempts to unlock a lock it never acquired, or fails to release one it did acquire. On ASICs without FAMS support, the divergence is reliably triggered, leaving the DMUB in a state that stalls subsequent display operations and produces a system hang.
Root Cause
The root cause is an inconsistent locking predicate [CWE-667]. The fix introduces a stored flag that records whether the lock was taken, and reuses that same flag to gate the unlock. By eliminating the duplicated predicate evaluation, acquire and release operations are guaranteed to be symmetric across all ASIC variants and FAMS configurations.
Attack Vector
Exploitation requires local access with low privileges. The attacker does not need user interaction. By invoking display-state operations that route through the HWSS fast path on a non-FAMS AMD ASIC, an unprivileged local user can induce the asymmetric lock condition and hang the kernel. There is no impact to confidentiality or integrity; the impact is limited to availability. No public proof-of-concept or exploitation in the wild has been reported.
No verified exploitation code is available. Refer to the upstream fix commits for the precise change in drm/amd/display: kernel.org commit 4e387ad6 and kernel.org commit af330397.
Detection Methods for CVE-2026-43305
Indicators of Compromise
- Unresponsive display pipeline or frozen GUI sessions on AMD GPU systems without FAMS support.
- Kernel soft-lockup or hung-task messages in dmesg referencing drm/amd/display or DMUB lock functions.
- Stalled kworker threads associated with the AMD display driver visible in /proc/<pid>/stack.
Detection Strategies
- Inventory running kernel versions across Linux endpoints and servers, and correlate against fixed upstream commits to identify unpatched systems.
- Monitor kernel ring buffer output for repeated hung_task warnings or watchdog timeouts tied to the AMD display subsystem.
- Track unexplained host availability incidents on workstations equipped with older AMD GPUs that lack FAMS firmware support.
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized analytics platform and alert on hung-task signatures involving DMUB or dc_lock.
- Track sudden drops in graphical session availability and correlate with kernel build identifiers.
- Validate kernel package versions during routine compliance scans and flag hosts pinned to vulnerable revisions.
How to Mitigate CVE-2026-43305
Immediate Actions Required
- Apply the upstream kernel fix or the distribution-provided update that incorporates commits 4e387ad6 and af330397.
- Prioritize patching workstations and shared multi-user hosts that include AMD GPUs without FAMS support.
- Restrict untrusted local user access on affected systems until the patched kernel is deployed.
Patch Information
The defect was resolved upstream in the Linux kernel by storing a single flag that governs both the acquisition and the release of the DMUB hardware lock in the HWSS fast path. Reference the official fix at kernel.org commit 4e387ad6 and the related update at kernel.org commit af330397. Consume the fix through your distribution's stable kernel channel rather than backporting manually where possible.
Workarounds
- Where patching is not immediately possible, limit interactive local logins on affected hosts to trusted users.
- Avoid display configurations and workloads that exercise the HWSS fast path on non-FAMS AMD ASICs.
- Consider rebooting on early signs of display-stack stalls to prevent extended outages while a patched kernel is staged.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
