HIGH Introduced in 6.0
drm/amd PlaneReset UAF
CVE-2026-93176
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dangling pointer in plane reset function amdgpu_dm_plane_drm_plane_reset() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory. Fix this by allocating the new state first. On allocation failure, the old state remains untouched and the function safely returns. Found by Linux Verification Center (linuxtesting.org) with SVACE. [adjust for movement around current amd-staging-drm-next]
02KernelScan AI Analysis
Risk summary
A local user with access to an AMD GPU's DRM device node can trigger a use-after-free in the display driver's plane reset function when a memory allocation fails under pressure. The dangling pointer to freed kernel memory can be exploited for code execution, information disclosure, or a system crash. Systems with AMD GPUs that expose the DRI device to untrusted or containerized workloads are at highest risk.
Vulnerability analysis
The AMD display driver's plane reset function destroys the existing plane state object before attempting to allocate a replacement. If the allocation fails — for instance under memory pressure — the function returns early, but the internal pointer still references the now-freed memory, turning any later access into a use-after-free. The fix reorders the operations so the new state is allocated first; only after a successful allocation is the old state destroyed, and a failed allocation leaves the previous state untouched and valid. This code path is reachable locally by any user with access to the AMD GPU's DRM device node, and triggering the bug requires inducing an allocation failure at the right moment.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.0 | 6.12.114 | 0999a267bdc1 |
| 6.18 | 6.0 | 6.18.57 | 3d8391d3149a |
| 6.6 | 6.0 | 6.6.160 | cda8af27b787 |
| 7.2 | 6.0 | 7.2.6 | 80c0f51aced4 |
| mainline | 6.0 | 7.3 | 98cad4bd1443 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |