drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (CVE-2026-80542) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-80542

drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()

Answer in brief

CVE-2026-80542 records a Unknown severity vulnerability in drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 26, 2026Updated Aug 26, 2026Source checked Aug 26, 2026First seen by HOL Aug 26, 2026Material review Aug 26, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=34d66bc7ff10e146a4cec76cf286979740a10954 <5045fb4c70bfde36a05e0f41cf35ddfb6d85d3af \|\| >=34d66bc7ff10e146a4cec76cf286979740a10954 <4a6bc92fac30070511d66bcce4ed9b7dac983180 \|\| >=34d66bc7ff10e146a4cec76cf286979740a10954 <f2a1c4c6fe0a6fcde02e59dde546dba28d283635	5045fb4c70bfde36a05e0f41cf35ddfb6d85d3af, 4a6bc92fac30070511d66bcce4ed9b7dac983180, f2a1c4c6fe0a6fcde02e59dde546dba28d283635
Linux/Linuxgeneric	6.18	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 5045fb4c70bfde36a05e0f41cf35ddfb6d85d3af if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 26, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached to it. BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu] Call Trace: drm_vblank_enable drm_vblank_get drm_crtc_get_sequence_ioctl drm_ioctl_kernel drm_ioctl Reproduced by running VKCTS with WSI tests enabled on RADV. Guard the enable path on acrtc_state->stream being non-NULL, matching the existing checks in this function. (cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39)

Quoted source text, attributed separately from HOL analysis.