---
id: "CVE-2026-99151"
kind: "vulnerability"
aliases: ["CVE-2026-99151"]
title: "Linux kernel AMD display driver: NULL sink pointer dereference crashes system"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["amd-gpu", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["no-amd-gpu"]
published_at: "2026-10-28T11:17:35+00:00"
first_seen_at: "2026-10-28T11:32:35+00:00"
updated_at: "2026-10-28T11:35:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99151", "first_seen_at": "2026-10-28T11:32:35+00:00"}]
---

# Linux kernel AMD display driver: NULL sink pointer dereference crashes system

In the AMD display driver's USB4 bandwidth functions, a missing NULL check on stream->sink can cause a NULL pointer dereference because the guarding ASSERT is compiled out of production builds. The sources describe this as a kernel crash condition and do not state that an attacker can run code through it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- Update the Linux kernel to a release that includes upstream commit 98029a0ce61feb52c563f65349dd9b25f672e355 or a later stable backport, as listed in the kernel stable trees.

## Timeline

- 2026-10-28T11:32:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99151

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions

allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both
use ASSERT(stream->sink) before dereferencing stream->sink->link. ASSERT
is compiled out in production builds, so a NULL stream->sink causes a
NULL pointer dereference.

link_set_dpms_off() already guards two earlier accesses to stream->sink
with explicit NULL checks, confirming that stream->sink can legitimately
be NULL. The subsequent call to deallocate_usb4_bandwidth() had no
equivalent guard.

Replace the ASSERT() calls with proper NULL checks that return false
early, and add a matching stream->sink guard at the call site in
link_set_dpms_off() consistent with the surrounding pattern.

v2: Keep the existing ASSERT() calls for diagnostics (to report
    unexpected NULL sink), and add explicit NULL checks that return false
    before dereferencing stream->sink. Also add a matching stream->sink
    guard at the deallocation call site in link_set_dpms_off(). (Alex)

(cherry picked from commit 98029a0ce61feb52c563f65349dd9b25f672e355)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_