CVE-2026-90035: Linux Kernel Display Driver DOS Vulnerability

CVE-2026-90035 Overview

CVE-2026-90035 is a division-by-zero flaw in the Linux kernel's AMD display (drm/amd/display) driver. The bug resides in get_estimated_bw(), which divides by link->dpia_bw_alloc_config.bw_granularity. That field is zeroed by reset_bw_alloc_struct() and only populated after a DP_TUNNELING_BW_ALLOC_CAP_CHANGED event is handled. A connected USB4/DPIA tunneling device that reports an estimated-bandwidth change before ever reporting a capability change triggers the divide-by-zero inside the DPCD interrupt handler link_dp_dpia_handle_bw_alloc_status(). The result is a kernel-level fault reachable through DisplayPort tunneling hardware interactions.

Critical Impact
A malicious or malfunctioning USB4/DPIA device can drive a kernel division by zero in an IRQ path, producing a denial-of-service condition on affected Linux systems.

Affected Products

Linux kernel drm/amd/display driver (upstream)
Systems using AMD display hardware with USB4/DPIA DisplayPort tunneling support
Stable branches receiving the backported fix referenced in kernel.org commits

Discovery Timeline

2026-09-16 - CVE-2026-90035 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90035

Vulnerability Analysis

The flaw is a classic divide-by-zero condition in kernel code that handles DisplayPort tunneling over USB4. get_estimated_bw() computes an estimated bandwidth by dividing a raw value by link->dpia_bw_alloc_config.bw_granularity. When a link is initialized or reset, reset_bw_alloc_struct() zeroes bw_granularity. The field is populated only after the driver processes a DP_TUNNELING_BW_ALLOC_CAP_CHANGED DPCD event, which advertises the granularity value from the connected tunneling device.

The DPCD interrupt handler link_dp_dpia_handle_bw_alloc_status() unconditionally invokes get_estimated_bw() whenever the DP_TUNNELING_ESTIMATED_BW_CHANGED bit is set. It does not check whether the capability-changed event has fired first. If a device sends an estimated-bandwidth change notification before the capability negotiation, the handler divides by zero inside interrupt context.

Root Cause

The root cause is missing input validation on bw_granularity before division. A sibling function, link_dpia_send_bw_alloc_request(), already guards the same division. The patch adds the identical guard to get_estimated_bw() rather than introducing a new pattern.

Attack Vector

The attack surface requires a physically or logically connected USB4/DPIA tunneling device that can craft DPCD interrupt notifications. A crafted or defective device that issues DP_TUNNELING_ESTIMATED_BW_CHANGED before DP_TUNNELING_BW_ALLOC_CAP_CHANGED triggers the fault. The result is a kernel oops or panic in the interrupt path, producing a denial-of-service condition.

See the upstream fix at Kernel Git Commit f63de90 for technical details on the guard added to the division.

Detection Methods for CVE-2026-90035

Indicators of Compromise

Kernel oops or panic messages referencing get_estimated_bw or link_dp_dpia_handle_bw_alloc_status in dmesg or the systemd journal.
Divide-by-zero exception traces originating in drm/amd/display on systems with USB4 DisplayPort tunneling.
Unexpected graphics-subsystem resets or display disconnects correlated with insertion of USB4/Thunderbolt DisplayPort tunneling peripherals.

Detection Strategies

Audit installed kernel versions against the fixed commits referenced in the kernel.org stable tree.
Correlate kernel crash telemetry with USB4/DPIA device connection events to identify triggering hardware.
Monitor for repeated drm/amd/display faults across fleets, which may indicate a defective or hostile tunneling peripheral.

Monitoring Recommendations

Forward kernel logs (kern.log, journalctl -k) to a centralized logging or SIEM platform for anomaly detection.
Alert on kernel panic strings containing divide error combined with amdgpu or dpia symbols.
Track USB4/Thunderbolt device connection events on endpoints with AMD display hardware.

How to Mitigate CVE-2026-90035

Immediate Actions Required

Apply the upstream kernel patches referenced in the CVE data as soon as distribution updates are available.
Update to a distribution kernel that includes the backported fix from the stable branches listed in the references.
On systems that cannot yet patch, restrict connection of untrusted USB4/Thunderbolt DisplayPort tunneling devices.

Patch Information

The fix adds a guard around the bw_granularity division in get_estimated_bw(), mirroring the existing guard in link_dpia_send_bw_alloc_request(). The upstream commit was cherry-picked to multiple stable branches. See the following references for the applied fixes: Kernel Git Commit 4814f28, Kernel Git Commit 4c5b61b, Kernel Git Commit ac2ab58, Kernel Git Commit b08c3d5, and Kernel Git Commit f63de90.

Workarounds

Disable USB4/Thunderbolt DisplayPort tunneling in firmware or BIOS on affected systems where the feature is not required.
Use organizational policy to block unauthorized USB4/Thunderbolt peripherals until patched kernels are deployed.
Where possible, disable the amdgpu DPIA bandwidth-allocation code path via kernel module parameters supported by the distribution.

bash

# Verify running kernel and check for fix
uname -r
# Update to a patched kernel via the distribution package manager
# Example (Debian/Ubuntu):
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f1-2)
# Example (Fedora/RHEL):
sudo dnf update kernel
# Reboot to activate the patched kernel
sudo reboot