CVE-2026-89819 Overview
CVE-2026-89819 is a Linux kernel vulnerability in the AMD display driver (drm/amd/display) affecting the per-plane degamma lookup table (LUT) handling. The __set_dm_plane_degamma() function passes a user-supplied LUT size directly to downstream helpers without validation. A malformed AMD_PLANE_DEGAMMA_LUT blob can trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(). The issue only manifests on kernel builds compiled with AMD_PRIVATE_COLOR enabled.
Critical Impact
Local users with access to the DRM interface can crash the kernel or read out-of-bounds memory by submitting a malformed plane degamma LUT property to an AMD GPU.
Affected Products
- Linux kernel builds with CONFIG_DRM_AMD_DC and AMD_PRIVATE_COLOR enabled
- AMD GPU display driver (amdgpu) plane color management path
- Distributions shipping the affected drm/amd/display code prior to the referenced stable commits
Discovery Timeline
- 2026-09-16 - CVE-2026-89819 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-89819
Vulnerability Analysis
The AMD display driver exposes an AMD_PLANE_DEGAMMA_LUT DRM property on kernels built with AMD_PRIVATE_COLOR. Userspace supplies a color LUT blob that the driver consumes when programming plane color pipelines. Unlike the CRTC degamma path, which validates LUT dimensions through amdgpu_dm_verify_lut_sizes(), the per-plane path had no equivalent check.
The unvalidated size flows into __is_lut_linear(), which uses the size value as a divisor when computing linearity. A LUT with fewer than the expected entries produces a division involving zero or a small value, resulting in a kernel divide-by-zero fault. For non-linear LUTs, the size is passed into __set_input_tf() and then __drm_lut_to_dc_gamma(), which always iterates MAX_COLOR_LUT_ENTRIES regardless of the actual blob length. This produces an out-of-bounds read past the end of the user-supplied buffer.
Root Cause
The root cause is missing input validation on a user-controlled size field before it is used in arithmetic and loop bounds. The invariant that the plane degamma LUT must contain exactly MAX_COLOR_LUT_ENTRIES entries was asserted later in the code path but never enforced at the entry point.
Attack Vector
Exploitation requires local access with permission to issue DRM ioctls against an AMD GPU device node such as /dev/dri/card0. An attacker submits a crafted AMD_PLANE_DEGAMMA_LUT blob with a mismatched entry count. Depending on the LUT contents, the result is either a kernel panic (denial of service) or an out-of-bounds memory read from adjacent kernel heap allocations.
No verified public exploit code is available. See the upstream fix commit e4c3ab59 for the corrected validation logic.
Detection Methods for CVE-2026-89819
Indicators of Compromise
- Kernel oops or panic messages referencing __is_lut_linear, __set_dm_plane_degamma, or __drm_lut_to_dc_gamma in dmesg or journalctl -k output
- Divide error traps originating in the amdgpu module on systems with AMD GPUs
- Unexpected SIGSEGV or GPU reset events correlated with unprivileged processes issuing DRM color-management ioctls
Detection Strategies
- Audit kernel crash telemetry for stack traces containing the affected AMD display driver symbols
- Correlate process execution with DRM ioctl activity targeting plane color properties on AMD hardware
- Monitor for repeated amdgpu faults from the same non-root user identifier, which suggests probing behavior
Monitoring Recommendations
- Enable kernel crash dump collection (kdump) and forward reports to a central log platform for pattern analysis
- Track loaded kernel versions across the fleet to identify hosts still running vulnerable amdgpu builds
- Alert on new local user sessions on systems that expose /dev/dri/* device nodes to unprivileged users
How to Mitigate CVE-2026-89819
Immediate Actions Required
- Update to a Linux kernel that includes one of the fix commits: 0b2615b8, b10cc09b, e4c3ab59, or f6f04d8a
- Prioritize patching multi-user Linux systems with AMD GPUs where untrusted local accounts have DRM access
- Restrict access to /dev/dri/* nodes to trusted users and the video/render groups only
Patch Information
The upstream fix rejects any plane degamma LUT whose size does not match MAX_COLOR_LUT_ENTRIES, mirroring the invariant already enforced by the CRTC path. Apply vendor kernel updates that backport one of the following commits: 0b2615b8, b10cc09b, e4c3ab59, or f6f04d8a.
Workarounds
- Rebuild the kernel without AMD_PRIVATE_COLOR if the private color management extensions are not required by userspace compositors
- Limit local logon access on affected systems until vendor-supplied patched kernels are deployed
- Tighten permissions on DRM device nodes to prevent untrusted users from issuing plane color ioctls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
