CVE-2026-80704: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80704 Overview

CVE-2026-80704 is a null pointer dereference vulnerability in the Linux kernel's AMD display driver (drm/amd/display). The flaw resides in get_ss_info_from_atombios(), which uses calc_pll_cs->ctx->logger for logging output. However, calc_pll_cs->ctx is not initialized until calc_pll_max_vco_construct() runs later in the sequence. Any log output through DC_LOG_SYNC() during initialization dereferences a NULL context pointer. The same defect exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers(). The upstream fix redirects logging to clk_src->base.ctx->logger, which is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct().

Critical Impact
A NULL pointer dereference during AMD GPU clock source initialization can trigger a kernel oops, resulting in local denial of service on affected systems.

Affected Products

Linux kernel with drm/amd/display (amdgpu) DRM driver
Kernel builds containing get_ss_info_from_atombios() prior to commit 6f16fcbb0c46
Distributions shipping unpatched stable kernels referenced by the upstream fix commits

Discovery Timeline

2026-08-28 - CVE-2026-80704 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80704

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in the AMD Display Core (DC) clock source initialization path. During construction of a DCE110 clock source, dce110_clk_src_construct() sets clk_src->base.ctx = ctx and then calls ss_info_from_atombios_create(), which invokes get_ss_info_from_atombios(). That function attempts to log through calc_pll_cs->ctx->logger, but calc_pll_cs->ctx remains NULL because calc_pll_max_vco_construct(), which assigns that context, has not yet executed.

Any logging macro that expands to DC_LOG_SYNC() during this window dereferences a NULL structure pointer inside kernel context. Sashiko identified the identical pattern in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers(), expanding the affected code paths across multiple Display Core Next (DCN) generations.

Root Cause

The root cause is an ordering defect between two context assignments on the same clock source object. The logging macro DC_LOGGER resolves to a field on a substructure (calc_pll_cs->ctx) that is populated later than the parent structure's context field (clk_src->base.ctx). Any early log statement produces a NULL dereference [CWE-476].

Attack Vector

Exploitation requires triggering the affected initialization code path on a system with an AMD GPU. The vulnerability is reachable during driver bring-up or reinitialization sequences that invoke get_ss_info_from_atombios() before calc_pll_max_vco_construct() completes. The practical impact is a kernel oops and denial of service on the affected host. No remote attack vector is described in the upstream commit.

The vulnerability is described in prose only; see the upstream kernel commits linked below for the exact source-level fix.

Detection Methods for CVE-2026-80704

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing get_ss_info_from_atombios, dce112_get_pix_clk_dividers, or dcn3_get_pix_clk_dividers
NULL pointer dereference stack traces originating in drivers/gpu/drm/amd/display/dc/
Unexpected display subsystem failures or GPU reinitialization events during boot on AMD hardware

Detection Strategies

Compare the running kernel version against the fixed commits (02647d98, 114b4250, a94e62b7, f556bc84, cherry-picked from 6f16fcbb0c46).
Audit distribution advisories for backported patches to the amdgpu DRM module.
Correlate crash dumps from kdump or systemd-coredump with the affected symbols to confirm exposure.

Monitoring Recommendations

Forward kernel log streams to a centralized logging platform and alert on BUG:, Oops:, or NULL pointer dereference messages tied to amdgpu.
Track GPU driver crash frequency on fleets using AMD graphics hardware.
Monitor stable kernel release notes and CVE feeds for backports referencing drm/amd/display context fixes.

How to Mitigate CVE-2026-80704

Immediate Actions Required

Update to a Linux kernel version that includes the upstream fix cherry-picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0.
Apply vendor-supplied kernel updates on distributions shipping affected stable branches.
Reboot affected hosts after patching to ensure the corrected amdgpu module is loaded.

Patch Information

The fix redefines DC_LOGGER to CTX->logger and routes all logging through clk_src->base.ctx->logger, which is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Patches are available in the mainline and stable trees: Kernel Git Commit 02647d98, Kernel Git Commit 114b4250, Kernel Git Commit a94e62b7, and Kernel Git Commit f556bc84.

Workarounds

No supported workaround replaces patching; the defect resides in kernel driver initialization order.
On systems where updating is not immediately possible, avoid operations that reinitialize the amdgpu display pipeline until a fixed kernel is deployed.
Where AMD graphics functionality is unnecessary, blacklisting the amdgpu module removes the vulnerable code path at the cost of losing GPU acceleration.

bash

# Verify running kernel and amdgpu module status
uname -r
lsmod | grep amdgpu

# Example: temporarily prevent amdgpu from loading on non-graphical hosts
echo "blacklist amdgpu" | sudo tee /etc/modprobe.d/blacklist-amdgpu.conf
sudo update-initramfs -u