CVE-2026-98785: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-30

Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend dc_state_create_copy() can return NULL on allocation failure. dm_suspend() only conditionally skips dm_gpureset_toggle_interrupts() and continues execution, returning success. dm_resume() then dereferences the NULL cached_dc_state in link_enc_cfg_copy() and the following dc_state->stream_count loop, crashing during GPU reset recovery. Return -ENOMEM immediately if the copy fails, so the caller aborts suspend instead of leaving a NULL cached state for resume. (cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab)

Affected products

Linux: from 5.15.165 before 5.15.224; from 6.1.105 before 6.1.191; from 6.6.46 before 6.6.160; from 5.10.258 before 5.11; from 6.10.5 before 6.11 — fixed in 5.15.224, 6.1.191, 6.6.160, 5.11, 6.11

How to fix

Upgrade to a fixed version: Linux 5.15.224, 6.1.191, 6.6.160, 5.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-98785 or the next vulnerability affects your stack