---
id: "CVE-2026-98926"
kind: "vulnerability"
aliases: ["CVE-2026-98926"]
title: "Linux kernel AMD display driver: DPMS path may dereference a null sink"
severity: "unknown"
cvss: null
epss: 0.00198
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["amd-gpu", "amdgpu", "infrastructure", "linux-kernel"]
not_affected_if: ["no-amd-gpu"]
published_at: "2026-10-23T13:17:13+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98926", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98926", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel AMD display driver: DPMS path may dereference a null sink

A Linux kernel fix in the AMD display driver removes use of a stream sink pointer during display power state changes, because that pointer can be null and was dereferenced without checks. The sources describe a robustness fix and do not state what an attacker gets from the unpatched code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98926
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98926

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Remove sink usage from DPMS

[Why]
stream->sink is optional and can be null, so should always be checked
before dereference. Additionally, most of its usage in DPMS sequences
is for stream->sink->link, which can be replaced with stream->link,
as the two should always be the same.

[How]
* Replace stream->sink->link in DPMS on/off
* Add assert to USB4 BW allocation where sink is required
* Avoid inconsistencies in resource access, e.g. don't repeat
stream->link after it was already saved to a local variable
* Pull out effective VPG calculation to helper getter
* Formatting fixes

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_