{"id":"CVE-2026-98786","kind":"vulnerability","aliases":["CVE-2026-98786"],"related":[],"title":"Linux amdgpu display: NULL pointer dereference during MST unplug races","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: guard dc_sink dereferences in MST mode validation\n\ndm_dp_mst_is_port_support_mode() reads\naconnector->dc_sink->dsc_caps... for the DSC branch-throughput check,\nand get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads\naconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL\ncheck. dc_sink is cleared asynchronously on MST unplug, and both\nfunctions run from paths that the driver's own comments document as\nracing that teardown: the connector probe worker's ->mode_valid\ncallback and a compositor's atomic check, neither of which holds the\nMST manager lock that the teardown path uses. The former does have an\nexisting dsc_aux NULL check, but dsc_aux isn't reliably cleared in\nevery path that clears dc_sink, so it doesn't cover this.\n\nFail the port-support check and skip the FRL conversion path when the\nsink is already gone.\n\n(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)","summary":"A race in the AMD display driver can dereference a cleared DisplayPort MST sink pointer when a monitor is unplugged during mode validation. The likely result is a kernel crash (denial of service); the sources do not describe code execution.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amdgpu","desktop","linux-kernel","runtime","workstation"],"not_affected_if":["no-amd-gpu","no-dp-mst"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream commit 7c3db8da4e039698ae198c870712428644e965c7 (the sources do not list fixed kernel versions).","status":"open","published_at":"2026-10-18T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:18+00:00","updated_at":"2026-10-25T05:15:18+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:15:18Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 7c3db8da4e039698ae198c870712428644e965c7 (the sources do not list fixed kernel versions).","reach":"local","title":"Linux amdgpu display: NULL pointer dereference during MST unplug races","impact":"low","summary":"A race in the AMD display driver can dereference a cleared DisplayPort MST sink pointer when a monitor is unplugged during mode validation. The likely result is a kernel crash (denial of service); the sources do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","amdgpu","desktop","workstation"],"confidence":0.6,"needs_auth":"no","worst_case":"kernel crash from a NULL dereference during monitor unplug","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["no-amd-gpu","no-dp-mst"],"who_is_affected":"Systems running a Linux kernel with the amdgpu display driver (AMD Radeon GPUs) and DisplayPort MST hubs or daisy-chained monitors, where monitors are hot-unplugged. Headless servers and systems without AMD display hardware are unlikely to be affected. The sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000603,"input_tokens":3609,"output_tokens":484,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98786':13A,16A '7c3db8da4e039698ae198c870712428644e965c7':232C 'aconnector':91C,117C 'alreadi':226C 'amd':28B 'amdgpu':2A,17B 'asynchron':132C 'atom':165C 'aux':187C,192C 'bandwidth':114C 'branch':100C 'branch-throughput':99C 'bw':107C 'callback':160C 'cap':95C 'check':102C,127C,166C,189C,215C 'cherri':228C 'clear':34B,131C,196C,201C 'code':62B 'comment':147C 'commit':231C 'compositor':163C 'connector':154C 'conv':105C 'convers':220C 'cover':208C 'crash':53B 'cve':11A,14A 'dc':76C,92C,118C,128C,202C 'denial':54B 'derefer':6A,32B,78C 'describ':61B 'desktop':18B 'display':3A,29B 'displayport':35B 'dm':83C 'document':148C 'doesn':206C 'dp':84C 'driver':30B,144C 'drm/amd/display':74C 'dsc':94C,98C,186C,191C 'edid_caps.max':120C 'everi':198C 'execut':63B 'exist':185C 'fail':210C 'follow':69C 'former':181C 'frl':106C,113C,121C,219C 'frl-bandwidth':112C 'function':138C 'get':104C 'gone':227C 'guard':75C 'hdmi':110C 'hdmi-pcon':109C 'hold':170C 'isn':193C 'kernel':21B,52B,67C 'like':48B 'linux':1A,20B,66C 'linux-kernel':19B 'lock':174C 'manag':173C 'mode':45B,81C,89C,158C 'monitor':41B 'mst':8A,36B,80C,85C,134C,172C 'neither':167C 'null':4A,126C,188C 'path':115C,141C,178C,199C,221C 'pcon':111C 'pick':229C 'pointer':5A,38B 'port':87C,213C 'port-support':212C 'probe':155C 'race':10A,25B,150C 'rate':122C 'read':90C,116C 'reliabl':195C 'resolv':73C 'result':49B 'run':139C 'runtim':22B 'servic':56B 'sink':37B,77C,93C,119C,129C,203C,224C 'skip':217C 'sourc':58B 'support':88C,214C 'teardown':152C,177C 'throughput':101C 'unplug':9A,43B,135C 'use':179C 'valid':46B,82C,159C 'vulner':70C 'without':124C 'worker':156C 'workstat':23B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the amdgpu display driver (AMD Radeon GPUs) and DisplayPort MST hubs or daisy-chained monitors, where monitors are hot-unplugged. Headless servers and systems without AMD display hardware are unlikely to be affected. The sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98786","severity":null,"published_at":"2026-10-18T16:17:32+00:00","modified_at":"2026-10-19T10:19:42+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}