CVE-2026-74732 Overview
CVE-2026-74732 is a NULL pointer dereference in the Linux kernel's AMD Display Core Engine (DCE) driver. The flaw resides in dce110_set_avmute within the drm/amd/display subsystem. Older DCE timing generators (TGs) do not implement the is_tg_enabled operation in their ops table. When the kernel calls this function unconditionally while waiting for Audio/Video mute frames, it dereferences a NULL function pointer. The condition triggers on Southern Islands discrete GPUs when the display is turned off over HDMI. The upstream fix adds a check that the timing generator and required ops exist before waiting for frames.
Critical Impact
Local users on affected systems can trigger a kernel NULL pointer dereference by disabling an HDMI display, leading to a denial-of-service condition on Southern Islands AMD dGPUs.
Affected Products
- Linux kernel drm/amd/display driver on systems using AMD Southern Islands (GCN 1.0) discrete GPUs
- Kernel branches prior to the backport commits 3141e3d, 5edbb40, 853c2d3, and d089f32
- HDMI-attached displays driven by legacy DCE timing generators
Discovery Timeline
- 2026-08-22 - CVE-2026-74732 published to NVD
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74732
Vulnerability Analysis
The defect is a NULL pointer dereference [CWE-476] inside the AMD display driver path that handles AV mute during HDMI display shutdown. The dce110_set_avmute routine waits for AV mute frames by calling into the timing generator's ops table. On legacy DCE hardware, the is_tg_enabled callback is not populated, so the pointer is NULL. Invoking it crashes the kernel with an oops. The impact is limited to system availability on affected AMD hardware; there is no indication of memory corruption or privilege escalation.
Root Cause
The root cause is a missing capability check before invoking an optional function pointer in the timing generator ops table. The DCE110 code path assumed all timing generator implementations would export is_tg_enabled. Older DCE variants shipped with Southern Islands hardware do not register this callback. Calling the unregistered ops entry dereferences a NULL pointer inside kernel context.
Attack Vector
Triggering the flaw requires local access to a Linux system running an unpatched kernel with an AMD Southern Islands dGPU and an HDMI-attached display. Any action that turns the HDMI output off — logout, DPMS, xrandr --output HDMI-1 --off, or a suspend cycle — walks the vulnerable code path. The result is a kernel oops and loss of the graphics subsystem, degrading the system to a non-interactive state. Remote exploitation is not applicable because the trigger depends on physical display state transitions on local hardware.
See the Kernel Git Commit 853c2d3 and Kernel Git Commit d089f32 for the exact source-level fix.
Detection Methods for CVE-2026-74732
Indicators of Compromise
- Kernel oops entries in dmesg or journalctl -k referencing dce110_set_avmute or is_tg_enabled on the call stack
- BUG: kernel NULL pointer dereference messages correlated with HDMI disable events or DPMS transitions
- System hangs or graphics stack failures immediately after HDMI output is turned off on Southern Islands dGPUs
Detection Strategies
- Inventory Linux endpoints that ship AMD Southern Islands GPUs (lspci -nn | grep -i amd) and cross-reference with kernel package versions
- Alert on kernel panic and oops events collected through host telemetry, filtering for amdgpu and drm module frames
- Monitor crash dumps in /var/crash and kdump outputs for stack traces including dce110_set_avmute
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and create a rule that flags NULL pointer dereferences originating in drm/amd/display
- Track kernel version drift across the fleet to identify hosts still exposed after upstream stable releases ship
- Correlate display state changes (session logout, lid-close, HDMI unplug) with subsequent kernel error events to confirm exploitability
How to Mitigate CVE-2026-74732
Immediate Actions Required
- Update to a Linux kernel that includes commits 3141e3d, 5edbb40, 853c2d3, or d089f32 from the stable tree
- Rebuild and reboot systems using AMD Southern Islands hardware to load the fixed amdgpu module
- Verify the fix by disabling HDMI output post-patch and confirming no kernel oops is generated
Patch Information
The fix adds a validation step that ensures the timing generator pointer and its is_tg_enabled op are non-NULL before waiting for AV mute frames. Backports are available in the stable kernel tree via Kernel Git Commit 3141e3d, Kernel Git Commit 5edbb40, Kernel Git Commit 853c2d3, and Kernel Git Commit d089f32. Apply the vendor-supplied kernel update from your distribution once the backport lands in the shipping stream.
Workarounds
- Avoid toggling HDMI output off on affected Southern Islands systems until the patched kernel is deployed
- Use DisplayPort or DVI outputs where available, as the vulnerable code path is exercised specifically during HDMI AV mute handling
- Pin affected hosts to a known-good kernel and defer suspend or DPMS operations that force display power-off transitions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
