{
  "threat_severity" : "Important",
  "public_date" : "2026-04-22T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation",
    "id" : "2460619",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2460619"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-1288",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\ndrm/amd/display: Do not skip unrelated mode changes in DSC validation\nStarting with commit 17ce8a6907f7 (\"drm/amd/display: Add dsc pre-validation in\natomic check\"), amdgpu resets the CRTC state mode_changed flag to false when\nrecomputing the DSC configuration results in no timing change for a particular\nstream.\nHowever, this is incorrect in scenarios where a change in MST/DSC configuration\nhappens in the same KMS commit as another (unrelated) mode change. For example,\nthe integrated panel of a laptop may be configured differently (e.g., HDR\nenabled/disabled) depending on whether external screens are attached. In this\ncase, plugging in external DP-MST screens may result in the mode_changed flag\nbeing dropped incorrectly for the integrated panel if its DSC configuration\ndid not change during precomputation in pre_validate_dsc().\nAt this point, however, dm_update_crtc_state() has already created new streams\nfor CRTCs with DSC-independent mode changes. In turn,\namdgpu_dm_commit_streams() will never release the old stream, resulting in a\nmemory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to\nthe new stream either, which manifests as a use-after-free when the stream gets\ndisabled later on:\nBUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu]\nWrite of size 4 at addr ffff88813d836524 by task kworker/9:9/29977\nWorkqueue: events drm_mode_rmfb_work_fn\nCall Trace:\n<TASK>\ndump_stack_lvl+0x6e/0xa0\nprint_address_description.constprop.0+0x88/0x320\n? dc_stream_release+0x25/0x90 [amdgpu]\nprint_report+0xfc/0x1ff\n? srso_alias_return_thunk+0x5/0xfbef5\n? __virt_addr_valid+0x225/0x4e0\n? dc_stream_release+0x25/0x90 [amdgpu]\nkasan_report+0xe1/0x180\n? dc_stream_release+0x25/0x90 [amdgpu]\nkasan_check_range+0x125/0x200\ndc_stream_release+0x25/0x90 [amdgpu]\ndc_state_destruct+0x14d/0x5c0 [amdgpu]\ndc_state_release.part.0+0x4e/0x130 [amdgpu]\ndm_atomic_destroy_state+0x3f/0x70 [amdgpu]\ndrm_atomic_state_default_clear+0x8ee/0xf30\n? drm_mode_object_put.part.0+0xb1/0x130\n__drm_atomic_state_free+0x15c/0x2d0\natomic_remove_fb+0x67e/0x980\nSince there is no reliable way of figuring out whether a CRTC has unrelated\nmode changes pending at the time of DSC validation, remember the value of the\nmode_changed flag from before the point where a CRTC was marked as potentially\naffected by a change in DSC configuration. Reset the mode_changed flag to this\nearlier value instead in pre_validate_dsc().\n(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b)", "A flaw was found in the Linux kernel's AMD display component. This vulnerability arises from incorrect validation of display mode changes during Display Stream Compression (DSC) processing. A local attacker could exploit this by initiating specific display configuration changes, which may lead to a memory leak and a use-after-free error. This could result in system crashes, denial of service, or potentially allow the attacker to gain elevated privileges." ],
  "statement" : "This is an Important flaw in the Linux kernel's AMD display driver, where incorrect handling of display mode changes during Display Stream Compression (DSC) processing can lead to a memory leak and use-after-free. A local attacker with the ability to initiate specific display configuration changes could exploit this to cause a denial of service or potentially escalate privileges. The vulnerability requires local access to the system.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-06-19T00:00:00Z",
    "advisory" : "RHSA-2026:27354",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.136.1.rt7.477.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-06-19T00:00:00Z",
    "advisory" : "RHSA-2026:27353",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.136.1.el8_10"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-31488\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31488\nhttps://lore.kernel.org/linux-cve-announce/2026042200-CVE-2026-31488-fe04@gregkh/T" ],
  "name" : "CVE-2026-31488",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}