CVE-2026-68436: Linux Kernel AMD Display DOS Vulnerability

CVE-2026-68436 Overview

CVE-2026-68436 is a Linux kernel vulnerability in the AMD GPU display driver (drm/amd/display). The struct dc structure grew large enough to approach the page allocator's 4 MiB contiguous allocation limit. When dc_create() calls kzalloc() for the structure and the size exceeds 4 MiB, the request is rounded to order 11 (8 MiB), which exceeds MAX_PAGE_ORDER. The page allocator emits a warning and returns NULL, causing display manager (DM) initialization to fail. The amdgpu probe then aborts with -EINVAL, leaving the display unusable on affected systems.

Critical Impact
A failed amdgpu probe prevents display initialization, resulting in an unusable graphics subsystem on systems where compiler or configuration changes push struct dc past the 4 MiB allocation ceiling.

Affected Products

Linux kernel drm/amd/display subsystem (amdgpu driver)
Kernel builds where struct dc size exceeds 4 MiB due to compiler version or .config settings
Systems relying on AMD display hardware initialized through amdgpu_dm_init

Discovery Timeline

2026-08-12 - CVE-2026-68436 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-68436

Vulnerability Analysis

The struct dc structure in the AMD display driver accumulated significant size over time, primarily from two inlined dc_scratch_space copies. Its final size is not fixed by source code alone; it depends on compiler behavior and kernel configuration. Newer GCC versions or configuration changes can push the structure across the 4 MiB threshold.

When dc_create() requests memory through kzalloc(), the allocator must find physically contiguous pages. Requests above 4 MiB round up to order 11 (8 MiB), which exceeds MAX_PAGE_ORDER. The allocator responds with a warning at mm/page_alloc.c:5197 in __alloc_frozen_pages_noprof and returns NULL.

The failure cascades: dc_create() returns NULL, amdgpu_dm_init() fails, dm_hw_init() fails, and amdgpu_device_init aborts with hw_init of IP block <dm> failed -22. Subsequent amdgpu_irq_put() warnings during teardown are fallout from unwinding a partially initialized device.

Root Cause

The root cause is an unnecessary demand for physically contiguous memory. struct dc is a software-only bookkeeping structure. It is never handed to hardware DMA and is only referenced through an opaque pointer. Using kzalloc() forces the allocator to satisfy the request with contiguous physical pages, which fails once the allocation size exceeds MAX_PAGE_ORDER.

Attack Vector

This issue manifests as a local availability failure during driver initialization rather than a remotely exploitable flaw. No network vector or authenticated user action triggers the condition. The failure occurs deterministically on affected kernel builds when amdgpu probes AMD display hardware.

The upstream fix replaces kzalloc() with kvzalloc() (freed via kvfree()), allowing the allocator to fall back to vmalloc() when a contiguous allocation of that size is not available. This avoids the MAX_PAGE_ORDER warning and lets the driver initialize successfully. See the upstream commit for the patch.

Detection Methods for CVE-2026-68436

Indicators of Compromise

Kernel log entry WARNING: mm/page_alloc.c:5197 at __alloc_frozen_pages_noprof+0x2f9/0x380 during boot
dc_create+0x38/0x660 [amdgpu] appearing in the warning backtrace
hw_init of IP block <dm> failed -22 message from amdgpu_device_init
amdgpu probe failure with -EINVAL and non-functional display output

Detection Strategies

Parse dmesg and journal logs for amdgpu probe failures paired with page_alloc warnings
Monitor systems after kernel or toolchain upgrades where struct dc size may change
Flag hosts where lspci -k shows AMD display hardware without an attached amdgpu driver

Monitoring Recommendations

Aggregate kernel warning messages centrally to identify allocation-order failures across the fleet
Track kernel package versions to confirm patched builds are deployed on AMD-equipped hosts
Alert on graphics stack initialization failures reported by systemd unit states or display manager services

How to Mitigate CVE-2026-68436

Immediate Actions Required

Upgrade to a Linux kernel release that includes the kvzalloc conversion for struct dc
On affected hosts that cannot patch immediately, avoid kernel rebuilds with newer GCC versions or configuration changes that inflate struct dc
Validate that AMD display hardware initializes cleanly after kernel updates by reviewing dmesg output

Patch Information

The fix replaces kzalloc() with kvzalloc() in dc_create() and uses kvfree() for release. This allows the allocator to fall back to vmalloc() when contiguous memory is unavailable. The patch is available in the stable tree at the primary commit and the backport commit.

Workarounds

Boot with a prior kernel build where struct dc remains under the 4 MiB threshold
Rebuild the kernel with a compiler or configuration known to keep struct dc below the allocation ceiling
Where display output is not required, disable the amdgpu display component to prevent probe failures from blocking other GPU functionality

bash

# Verify installed kernel and check for the amdgpu probe warning
uname -r
dmesg | grep -E 'amdgpu|dc_create|page_alloc'