CVE-2026-68235: Linux Kernel AMD Display DoS Vulnerability

CVE-2026-68235 Overview

CVE-2026-68235 is a NULL pointer dereference vulnerability in the Linux kernel amdgpu driver, specifically in the drm/amd/display DCE100 code path. The flaw affects DCE8-class AMD ASICs such as the Bonaire-based Radeon R7 260X. When assigning a stream encoder for a second DisplayPort Multi-Stream Transport (MST) stream, the dce100_find_first_free_match_stream_enc_for_link() function can return an analog DAC encoder that lacks DisplayPort function hooks. The subsequent atomic commit dereferences NULL function pointers in link_set_dpms_on(), producing a kernel oops. The issue has been observed since Linux 6.19 and reproduces reliably with DP MST daisy-chain configurations.

Critical Impact
Local users with the ability to trigger a DP MST hotplug on affected AMD hardware can cause a kernel oops, resulting in a denial of service on the display subsystem.

Affected Products

Linux kernel drm/amd/display subsystem on DCE8-class ASICs (e.g., AMD Radeon R7 260X / Bonaire)
Linux kernel versions from 6.19 through 7.1.3 prior to the fix
Systems using DisplayPort Multi-Stream Transport (MST) daisy-chained monitors on affected GPUs

Discovery Timeline

2026-08-10 - CVE-2026-68235 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68235

Vulnerability Analysis

The vulnerability resides in the AMD Display Core (DC) resource allocation logic for DCE100-family hardware. On DCE8-class ASICs, the resource pool contains multiple digital DIG stream encoders plus one analog DAC encoder. When the driver assigns a stream encoder for a DisplayPort MST stream, it first attempts to pick the preferred digital encoder. If that encoder is already acquired for another stream, the fallback path in dce100_find_first_free_match_stream_enc_for_link() selects the first free entry in the pool without validating that the entry supports DisplayPort.

The analog DAC encoder is eligible under this fallback because the existing check only inspects the link connector signal rather than the actual stream signal. The DAC encoder's funcs table does not implement DP-specific hooks such as dp_set_stream_attribute. When link_set_dpms_on() later attempts to invoke that callback, the kernel dereferences a NULL function pointer and panics.

Root Cause

The root cause is an improper input validation error [CWE-476] in the encoder selection fallback. The selection logic checks only the connector signal on the link rather than the full stream signal returned by dc_is_dp_signal(stream->signal). As a result, MST streams that traverse a non-DP-capable encoder pass the eligibility check and later reach code paths that assume DP function pointers are populated.

Attack Vector

Exploitation requires local physical or administrative access to trigger a DP MST hotplug event. An attacker connects a second monitor over a DP MST daisy chain, or boots with the second monitor already attached, on affected AMD hardware. The atomic modeset commit path then dereferences the NULL dp_set_stream_attribute pointer, crashing the kernel. There is no known remote or unauthenticated attack vector, and no arbitrary code execution primitive has been demonstrated. The fix skips encoders lacking dp_set_stream_attribute when the stream signal is DP (including MST), forcing the allocator to select only DP-capable encoders.

Detection Methods for CVE-2026-68235

Indicators of Compromise

Kernel oops or panic messages referencing link_set_dpms_on or dp_set_stream_attribute in dmesg or /var/log/kern.log.
Unexpected display subsystem crashes coinciding with DP MST hotplug events on AMD DCE8 hardware.
System log entries showing amdgpu atomic commit failures during modeset on multi-monitor setups.

Detection Strategies

Inventory Linux hosts running kernels 6.19 through 7.1.3 with AMD GPUs from the DCE8 generation, such as Bonaire-based cards.
Correlate kernel crash telemetry with display hotplug events using centralized log aggregation.
Review crash dumps for stack traces terminating in amdgpu display code paths tied to MST stream allocation.

Monitoring Recommendations

Ingest dmesg and kernel crash logs into a centralized SIEM to identify recurring amdgpu oops signatures.
Alert on kernel panics on workstations and thin-client hosts that drive multi-monitor DisplayPort configurations.
Track kernel package versions across the fleet to identify systems still running vulnerable kernels prior to the stable backport.

How to Mitigate CVE-2026-68235

Immediate Actions Required

Update affected Linux hosts to a stable kernel that contains the fix backported from upstream commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8.
Prioritize patching workstations and kiosks using AMD DCE8-class GPUs with DP MST daisy-chained displays.
If patching is delayed, avoid DP MST configurations on affected hardware and connect monitors directly to distinct outputs.

Patch Information

The fix has been merged upstream and cherry-picked to stable trees. Refer to the kernel commits at Linux Kernel Commit 51ea665c, Linux Kernel Commit bfe28ce0, Linux Kernel Commit d340cba0, and Linux Kernel Commit ed2d86ae. The patch modifies dce100_find_first_free_match_stream_enc_for_link() to skip encoders without dp_set_stream_attribute when dc_is_dp_signal(stream->signal) returns true.

Workarounds

Disable DP MST on affected AMD DCE8 GPUs and connect displays through separate physical outputs.
Downgrade to a kernel earlier than 6.19 on hosts where operational requirements permit.
Restrict physical access to systems that cannot be immediately patched to prevent unauthorized hotplug-triggered crashes.

bash

# Verify running kernel version and check for the fix
uname -r

# On distributions that ship changelog metadata, confirm the backport is present
rpm -q --changelog kernel | grep -i "dce100\|dp_set_stream_attribute"
# or for Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -i "dce100\|dp_set_stream_attribute"