-

CVE-2026-93068

drm/amd/display: Fix DM I2C teardown race

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix DM I2C teardown race

DM I2C adapters can remain visible to userspace while DM teardown is
already in progress. A concurrent i2c-dev transfer may then enter
amdgpu_dm_i2c_xfer() after the backing DM state has been torn down,
leading to a NULL pointer dereference.

Create a devres group around the DM I2C adapter lifetime and release it
at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn
down. This removes the I2C adapters first and waits for in-flight users
to drain before the structures used by amdgpu_dm_i2c_xfer() disappear.

This fixes a teardown ordering race seen during device removal:

BUG: kernel NULL pointer dereference
RIP: amdgpu_dm_i2c_xfer+0x122/0x1c0 [amdgpu]
Call Trace:
__i2c_transfer
i2c_transfer
i2cdev_ioctl_rdwr
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3
Version < 8ee385305e8902fa6fbfd66b5a112238292567b6
Status affected
Version 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3
Version < 6970ec944567f109ac4240f9aea58158ee8a18cd
Status affected
Version 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3
Version < e4ae30a12aa95942814957d8bc1ce7366a7107d7
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.18
Status affected
Version 0
Version < 6.18
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.099
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/8ee385305e8902fa6fbfd66b5a112238292567b6
https://git.kernel.org/stable/c/6970ec944567f109ac4240f9aea58158ee8a18cd
https://git.kernel.org/stable/c/e4ae30a12aa95942814957d8bc1ce7366a7107d7