{"id":"CVE-2026-99151","kind":"vulnerability","aliases":["CVE-2026-99151"],"related":[],"title":"Linux kernel AMD display driver: NULL sink pointer dereference crashes system","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions\n\nallocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both\nuse ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT\nis compiled out in production builds, so a NULL stream->sink causes a\nNULL pointer dereference.\n\nlink_set_dpms_off() already guards two earlier accesses to stream->sink\nwith explicit NULL checks, confirming that stream->sink can legitimately\nbe NULL. The subsequent call to deallocate_usb4_bandwidth() had no\nequivalent guard.\n\nReplace the ASSERT() calls with proper NULL checks that return false\nearly, and add a matching stream->sink guard at the call site in\nlink_set_dpms_off() consistent with the surrounding pattern.\n\nv2: Keep the existing ASSERT() calls for diagnostics (to report\n    unexpected NULL sink), and add explicit NULL checks that return false\n    before dereferencing stream->sink. Also add a matching stream->sink\n    guard at the deallocation call site in link_set_dpms_off(). (Alex)\n\n(cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)","summary":"In the AMD display driver's USB4 bandwidth functions, a missing NULL check on stream->sink can cause a NULL pointer dereference because the guarding ASSERT is compiled out of production builds. The sources describe this as a kernel crash condition and do not state that an attacker can run code through it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amd-gpu","linux-kernel","runtime","self-hosted"],"not_affected_if":["no-amd-gpu"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes upstream commit 98029a0ce61feb52c563f65349dd9b25f672e355 or a later stable backport, as listed in the kernel stable trees.","status":"open","published_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:35:54+00:00","updated_at":"2026-10-28T11:35:54+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:35:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes upstream commit 98029a0ce61feb52c563f65349dd9b25f672e355 or a later stable backport, as listed in the kernel stable trees.","reach":"local","title":"Linux kernel AMD display driver: NULL sink pointer dereference crashes system","impact":"low","summary":"In the AMD display driver's USB4 bandwidth functions, a missing NULL check on stream->sink can cause a NULL pointer dereference because the guarding ASSERT is compiled out of production builds. The sources describe this as a kernel crash condition and do not state that an attacker can run code through it.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","amd-gpu","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel NULL dereference causes a crash or denial of service","analyst_note":"Check the NVD entry and the kernel.org stable commit for the affected and fixed kernel version ranges, and whether the trigger is reachable by an unprivileged user.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-amd-gpu"],"who_is_affected":"Systems running a Linux kernel with the amdgpu display driver (drm/amd/display) and USB4 or Thunderbolt display paths. Systems without AMD graphics hardware or without this driver loaded are not affected. The sources do not give the exact affected version ranges.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000642,"input_tokens":3673,"output_tokens":549,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99151':14A,17A '98029a0ce61feb52c563f65349dd9b25f672e355':249C 'access':142C 'add':182C,216C,228C 'alex':244C 'alloc':98C,104C 'alreadi':138C 'also':227C 'amd':3A,19B,30B 'amd-gpu':18B 'assert':53B,109C,117C,171C,206C 'attack':75B 'bandwidth':35B,96C,100C,106C,164C 'build':59B,123C 'call':160C,172C,190C,207C,237C 'caus':45B,129C 'check':40B,149C,176C,219C 'cherri':245C 'code':78B 'commit':248C 'compil':55B,119C 'condit':68B 'confirm':150C 'consist':197C 'crash':10A,67B 'cve':12A,15A 'dealloc':162C,236C 'derefer':9A,49B,93C,133C 'dereferenc':113C,224C 'describ':62B 'diagnost':209C 'display':4A,31B 'dpms':136C,195C,242C 'driver':5A,32B 'drm/amd/display':89C 'earli':180C 'earlier':141C 'equival':167C 'exist':205C 'explicit':147C,217C 'fals':179C,222C 'fix':90C 'follow':84C 'function':36B,97C 'gpu':20B 'guard':52B,139C,168C,187C,233C 'host':27B 'keep':203C 'kernel':2A,23B,66B,82C 'legitim':155C 'link':116C,134C,193C,240C 'linux':1A,22B,81C 'linux-kernel':21B 'match':184C,230C 'miss':38B 'null':6A,39B,47B,91C,126C,131C,148C,157C,175C,213C,218C 'pattern':201C 'pick':246C 'pointer':8A,48B,132C 'product':58B,122C 'proper':174C 'replac':169C 'report':211C 'resolv':88C 'return':178C,221C 'run':77B 'runtim':24B 'self':26B 'self-host':25B 'set':135C,194C,241C 'sink':7A,43B,92C,111C,115C,128C,145C,153C,186C,214C,226C,232C 'site':191C,238C 'sourc':61B 'state':72B 'stream':42B,102C,110C,114C,127C,144C,152C,185C,225C,231C 'subsequ':159C 'surround':200C 'system':11A 'two':140C 'unexpect':212C 'usb4':34B,95C,99C,105C,163C 'use':108C 'v2':202C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the amdgpu display driver (drm/amd/display) and USB4 or Thunderbolt display paths. Systems without AMD graphics hardware or without this driver loaded are not affected. The sources do not give the exact affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99151","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99151","severity":null,"published_at":"2026-10-28T11:17:35+00:00","modified_at":"2026-10-28T11:17:35+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}