CVE-2026-80542: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80542 Overview

CVE-2026-80542 is a NULL pointer dereference vulnerability in the Linux kernel's AMD GPU Direct Rendering Manager (DRM) display driver. The flaw resides in the amdgpu_dm_crtc_set_vblank() function within drm/amd/display, which dereferences acrtc_state->stream before a stream has been attached to the CRTC. Local unprivileged users can trigger the condition through the DRM_IOCTL_MODE_CRTC_GET_SEQUENCE ioctl when vblank is enabled or queried. The issue was reproduced by running the Vulkan Conformance Test Suite (VKCTS) with Window System Integration (WSI) tests enabled on the RADV driver, resulting in a kernel oops.

Critical Impact
Local users can crash the Linux kernel by issuing a DRM ioctl before a display stream is attached, resulting in a denial-of-service condition on systems using AMD graphics.

Affected Products

Linux kernel drm/amd/display subsystem (amdgpu driver)
Systems using AMD GPU hardware with the DRM/KMS stack
Stable kernel branches referenced by fix commits 4a6bc92, 5045fb4, and f2a1c4c

Discovery Timeline

2026-08-26 - CVE-2026-80542 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80542

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in the amdgpu display driver. The function amdgpu_dm_crtc_set_vblank() accesses acrtc_state->stream without first verifying that the stream pointer is valid. When userspace issues DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before the CRTC has an associated display stream, the kernel dereferences a NULL pointer at offset 0x8, triggering a kernel oops.

The reported crash trace shows the fault path traversing drm_ioctl → drm_ioctl_kernel → drm_crtc_get_sequence_ioctl → drm_vblank_get → drm_vblank_enable → amdgpu_dm_crtc_set_vblank+0x6b/0x4d0. The oops address 0000000000000008 corresponds to a field offset within the expected stream structure.

Root Cause

The root cause is missing input validation on the CRTC state. Other code paths in amdgpu_dm_crtc_set_vblank() already guard against a NULL stream, but the enable path did not. The fix, cherry-picked from upstream commit 7b1b31bf6942e6f43509b48da23f8e27269aac39, adds a check that acrtc_state->stream is non-NULL before dereferencing it, matching the existing defensive checks elsewhere in the function.

Attack Vector

Exploitation requires local access with the ability to open a DRM device node and issue ioctls. An attacker calls DRM_IOCTL_MODE_CRTC_GET_SEQUENCE on a CRTC that does not yet have a display stream attached, causing the kernel to dereference NULL and panic. The condition is reproducible through standard graphics stacks; VKCTS with WSI tests on RADV triggers the crash reliably. The impact is a denial of service against the running kernel rather than privilege escalation or information disclosure.

Detection Methods for CVE-2026-80542

Indicators of Compromise

Kernel oops entries in dmesg referencing amdgpu_dm_crtc_set_vblank+0x6b and a fault address near 0x0000000000000008.
Call trace containing drm_crtc_get_sequence_ioctl followed by drm_vblank_enable immediately before the fault.
Unexpected system crashes or graphical session resets on hosts running AMD GPUs with the amdgpu driver.

Detection Strategies

Correlate kernel crash logs (/var/log/kern.log, journalctl -k) for NULL pointer dereferences originating in the amdgpu module.
Audit installed kernel versions against the fixed commits 4a6bc92fac30, 5045fb4c70bf, and f2a1c4c6fe0a to identify unpatched hosts.
Monitor for repeated invocation of DRM ioctls from unprivileged processes preceding kernel faults.

Monitoring Recommendations

Forward kernel logs to a central telemetry pipeline and alert on oops signatures containing amdgpu_dm_crtc_set_vblank.
Track kernel package versions across the fleet to confirm rollout of stable updates containing the fix.
Baseline expected DRM ioctl activity on multi-user systems and flag anomalies from non-graphical user sessions.

How to Mitigate CVE-2026-80542

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the fix commits 4a6bc92, 5045fb4, or f2a1c4c.
Reboot affected hosts after upgrading to load the patched kernel image.
Restrict local shell and DRM device access on shared multi-user systems until patches are deployed.

Patch Information

The upstream fix guards the enable path in amdgpu_dm_crtc_set_vblank() with a non-NULL check on acrtc_state->stream, matching existing checks in the same function. It was cherry-picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39. Backports are available in the stable trees referenced by Kernel Git Commit 4a6bc92, Kernel Git Commit 5045fb4, and Kernel Git Commit f2a1c4c.

Workarounds

Limit access to /dev/dri/* device nodes to trusted users through group permissions on shared systems.
Avoid running untrusted Vulkan or DRM test suites, including VKCTS with WSI tests, on production hosts.
Where feasible, switch workloads to hardware or drivers not affected by the amdgpu display path until the kernel is patched.

bash

# Verify running kernel and check for patched commit in changelog
uname -r
rpm -q --changelog kernel | grep -E '4a6bc92|5045fb4|f2a1c4c|amdgpu_dm_crtc_set_vblank'

# Restrict DRM device access to the video group
ls -l /dev/dri/
sudo chown root:video /dev/dri/card*
sudo chmod 0660 /dev/dri/card*