CVE-2026-53285 Overview
CVE-2026-53285 affects the Linux kernel drm/amd/display subsystem. The flaw resides in the DCN32 bandwidth validation path, where dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() between DC_FP_START() and DC_FP_END(). On x86 non-RT kernels, DC_FP_START acquires fpregs_lock(), which disables local softirqs. Inside this region, the DML1 path calls dcn32_enable_phantom_plane(), which invokes kvzalloc() to allocate roughly 335 KiB for dc_plane_state. That allocation reaches the vmalloc path and triggers BUG_ON(in_interrupt()), resulting in a kernel crash. The fix wraps the dc_state_create_phantom_plane() call in the DC_RUN_WITH_PREEMPTION_ENABLED() macro to permit preemption during the allocation.
Critical Impact
A local user triggering DCN32 display validation on affected AMD GPU hardware can cause a kernel BUG_ON crash and denial of service.
Affected Products
- Linux kernel builds including the drm/amd/display DCN32 driver prior to the referenced stable commits
- Systems using AMD GPUs handled by the DCN32 display pipeline (DML1 path)
- x86 non-RT kernel configurations where DC_FP_START disables softirqs via fpregs_lock()
Discovery Timeline
- 2026-06-26 - CVE-2026-53285 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53285
Vulnerability Analysis
The bug is a kernel-context violation in the AMD Display Core (DC) code. dcn32_validate_bandwidth() executes bandwidth calculations that require FPU state, so it brackets its work with DC_FP_START() and DC_FP_END(). On x86 non-RT kernels, DC_FP_START takes fpregs_lock(), which disables local softirqs and forbids sleeping or entering the vmalloc slow path.
Inside that FPU-protected region, the DML1 code path enters dcn32_enable_phantom_plane() and requests a dc_plane_state object roughly 335 KiB in size via kvzalloc(). Allocations of this size fall through kmalloc and reach vmalloc, which enforces BUG_ON(in_interrupt()). The check fires because interrupt/softirq context is treated as disallowed, and the kernel panics.
Root Cause
The root cause is an invalid nesting of a large kvzalloc() allocation inside an FPU-enabled, softirq-disabled region. The DML1 code path did not account for the constraint that memory allocations reaching vmalloc must run with preemption and softirqs enabled. This is a kernel context / atomicity violation rather than a memory-safety bug.
Attack Vector
Triggering the crash requires a code path that exercises DCN32 bandwidth validation with the DML1 phantom-plane allocation, which is reachable from display mode configuration on affected AMD GPU hardware. The result is a local denial of service through a kernel BUG_ON. No remote vector is described in the advisory, and no public exploit is available.
The upstream fix wraps dc_state_create_phantom_plane() with the DC_RUN_WITH_PREEMPTION_ENABLED() macro so the allocation runs outside the FPU-locked region. See the Kernel Git Commit Fix and Kernel Git Commit Update for the patch content, cherry-picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11.
Detection Methods for CVE-2026-53285
Indicators of Compromise
- Kernel panic or BUG: messages referencing BUG_ON(in_interrupt()) from the vmalloc code path
- Stack traces including dcn32_validate_bandwidth, dcn32_internal_validate_bw, dcn32_enable_phantom_plane, or dc_state_create_phantom_plane
- Crashes occurring during display mode changes, monitor hotplug, or resume from suspend on AMD DCN32 hardware
Detection Strategies
- Compare the running kernel against the fixed stable commits 183182235f6d and 30bb2ec6695d to identify unpatched systems
- Parse dmesg, journalctl -k, and crash dumps for the signature call chain listed above
- Inventory endpoints with AMD GPUs that use the DCN32 display block to scope exposure
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on BUG_ON, kernel panic, and repeated amdgpu faults
- Track kernel package versions across the fleet and flag hosts still running pre-patch builds
- Correlate crash events with display reconfiguration or graphics workloads to confirm this root cause
How to Mitigate CVE-2026-53285
Immediate Actions Required
- Update to a Linux kernel that includes the fix commits 183182235f6d53bac62c6c39014738a54a68dfa6 and 30bb2ec6695d62f63db4aa6179c4626834ed0cd6
- Prioritize patching workstations and servers with AMD GPUs driven by the DCN32 pipeline
- Enable automated kernel update policies on affected distributions to prevent regression
Patch Information
The upstream fix cherry-picks commit 885ccbef7b94a8b38f69c4211c679021aa27ad11 and wraps dc_state_create_phantom_plane() in the DC_RUN_WITH_PREEMPTION_ENABLED() macro, moving the large kvzalloc() allocation outside the FPU-locked, softirq-disabled region. Apply the vendor kernel package that incorporates the Kernel Git Commit Fix and Kernel Git Commit Update.
Workarounds
- Avoid display configurations that exercise the DCN32 DML1 phantom-plane path on unpatched hosts where feasible
- Restrict interactive access on affected systems so untrusted users cannot repeatedly trigger display reconfiguration
- Roll back to an earlier known-good kernel that does not exhibit this crash if a patched build is not yet available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
