CVE-2026-80705 Overview
CVE-2026-80705 is a Linux kernel vulnerability in the AMD Display Manager Library 2.1 (DML21) component of the amdgpu DRM driver. The flaw exists in the phantom plane allocation path, where the return value of dml21_add_phantom_plane() was not checked before use. When allocation fails, a subsequent dereference of the phantom plane pointer triggers a segmentation fault in kernel space. The upstream fix adds a success check to prevent the null pointer dereference. The patch was cherry-picked into stable trees under commits 000acb4 and 062cfd6.
Critical Impact
A failed phantom plane allocation in the AMD display pipeline can lead to a kernel-mode null pointer dereference and system crash on affected AMD GPU hardware.
Affected Products
- Linux kernel drm/amd/display subsystem (DML21 code path)
- Systems running the amdgpu driver with AMD DCN hardware supporting phantom planes
- Stable kernel branches prior to the backport of upstream commit 5adb54abe5a8
Discovery Timeline
- 2026-08-28 - CVE-2026-80705 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80705
Vulnerability Analysis
The vulnerability resides in the Display Mode Library 2.1 (DML21) inside the AMD display driver (drivers/gpu/drm/amd/display). DML21 constructs phantom planes to support subviewport (SubVP) power-saving features on modern AMD DCN pipelines. The helper dml21_add_phantom_plane() allocates and registers a phantom plane object used later during mode set and validation. Prior to the fix, the caller consumed the returned pointer without verifying that allocation succeeded. When the allocator returned NULL due to memory pressure or internal limits, later code paths dereferenced the pointer, producing a kernel segfault.
Root Cause
The root cause is a missing success check on a function return value, a classic Null Pointer Dereference pattern in kernel driver code. The corrective patch verifies that the phantom plane pointer is non-null before continuing, and gracefully aborts the operation otherwise. This aligns with defensive allocation handling practiced elsewhere in the DRM/KMS stack.
Attack Vector
The vulnerability is triggered along the display mode configuration path exercised by the kernel during atomic commits and display topology changes. Local users with the ability to drive display configuration through standard DRM interfaces can potentially reach the vulnerable code path. Successful triggering results in a kernel oops or panic affecting availability. No remote attack vector is documented, and no public exploit or proof-of-concept has been referenced in the enriched data.
No verified exploit code is available. Refer to the upstream commits Kernel Git Commit 000acb4 and Kernel Git Commit 062cfd6 for the exact source-level change.
Detection Methods for CVE-2026-80705
Indicators of Compromise
- Kernel oops or panic messages referencing dml21_add_phantom_plane or nearby DML21 symbols in dmesg and /var/log/kern.log.
- Unexpected display subsystem crashes during atomic mode set, resume from suspend, or hotplug events on AMD GPU systems.
- Repeated allocation failures logged by the amdgpu driver preceding display pipeline faults.
Detection Strategies
- Inventory Linux hosts using the amdgpu driver and compare running kernel versions against distribution advisories that reference commits 000acb4 and 062cfd6.
- Correlate kernel crash telemetry with display-related stack traces to identify systems hitting the vulnerable code path.
- Use package manager queries (rpm -q kernel, dpkg -l linux-image-*) to confirm patched kernel builds are deployed on AMD workstations and servers.
Monitoring Recommendations
- Forward kernel logs and crash dumps to a centralized logging platform and alert on repeated amdgpu faults.
- Track kernel version drift across the fleet, prioritizing endpoints with AMD discrete GPUs used in engineering and media workloads.
- Monitor vendor kernel security update feeds for backports referencing drm/amd/display phantom plane fixes.
How to Mitigate CVE-2026-80705
Immediate Actions Required
- Update to a Linux kernel that contains the backport of upstream commit 5adb54abe5a8e82cbff7f8806db30a5f4924329f, delivered as stable commits 000acb4 and 062cfd6.
- Apply distribution-provided kernel updates on all systems using amdgpu and reboot to activate the new kernel image.
- Prioritize workstations and servers with AMD DCN-class GPUs where display topology changes are frequent.
Patch Information
The fix adds an explicit success check after dml21_add_phantom_plane() and aborts the operation if allocation returned NULL, eliminating the downstream dereference. Reference the upstream stable commits Kernel Git Commit 000acb4 and Kernel Git Commit 062cfd6 for the authoritative source change.
Workarounds
- Where patching is not immediately feasible, avoid enabling features that rely on DML21 phantom planes such as SubVP on affected hardware and kernels.
- Constrain local user access to systems running vulnerable kernels to reduce the population able to trigger display reconfiguration paths.
- Increase available memory headroom on affected hosts to reduce the likelihood of allocation failure in the phantom plane path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
