CVE-2026-53285: AMD DCN32 Linux Kernel Phantom Plane Memory Allocation Crash

Technical summary

The vulnerability exists in the Linux kernel's AMD display (DRM) subsystem, specifically in the DCN32 phantom-plane allocation logic. The dcn32_validate_bandwidth() function wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END() macros. On x86 non-RT kernels, DC_FP_START() acquires fpregs_lock(), which disables local softirqs. The DML1 bandwidth validation path invokes dcn32_enable_phantom_plane(), which calls kvzalloc() to allocate approximately 335 KiB for a dc_plane_state structure. This large allocation triggers the vmalloc() code path, which contains a BUG_ON(in_interrupt()) check that fails because the allocation occurs within the FPU-enabled softirq-disabled region, resulting in an immediate kernel crash. The fix wraps the dc_state_create_phantom_plane() call with DC_RUN_WITH_PREEMPTION_ENABLED() to allow preemption and softirq handling during memory allocation.

Business impact

Systems running affected Linux kernel versions with AMD display hardware (particularly those relying on DCN32 validation) face availability risk. A local privileged user can crash the kernel through display bandwidth validation operations, resulting in system downtime. This impacts workstations and servers with AMD GPUs or APUs where the DCN32 display controller is active and where local users with privilege can trigger display configuration changes or bandwidth recalculation.

Affected systems

Affected systems include Linux kernels with AMD DCN32 display driver code paths. The vulnerability requires local access and elevated privileges (CWE-617 indicates a missing authorization check context). Systems are only impacted if they use AMD display hardware that exercises the DML1 bandwidth validation path during phantom plane allocation. The specific kernel versions affected are determined by the upstream kernel tree; check your vendor's security advisory for precise version ranges and backport status across supported distributions.

Exploitability

This vulnerability has low exploitability barriers for users who already possess local privileged access. No network attack vector exists (local only). An authenticated user with privileges sufficient to trigger display reconfiguration or bandwidth validation can induce the crash. The condition is deterministic once triggered—the kvzalloc() allocation for phantom plane state reliably hits the vmalloc() path on the affected code path. Exploitation does not require sophisticated techniques, but is limited to privileged local users.

Remediation

Apply kernel patches that implement the DC_RUN_WITH_PREEMPTION_ENABLED() wrapper around the phantom plane allocation, as described in upstream commit 885ccbef7b94a8b38f69c4211c679021aa27ad11. This fix has been cherry-picked into stable and vendor-maintained kernel branches. Verify the exact patched kernel version from your Linux distributor's security advisory. For immediate mitigation, restrict local user access and privileges on affected systems where AMD display drivers are in use.

Patch guidance

Obtain patched kernel versions from your Linux distribution's security updates. The upstream fix is available in the kernel tree; verify it has been backported to your kernel branch and version. Red Hat, Ubuntu, SUSE, and other distributors typically release tested versions through their standard security update channels. Apply kernel updates during your standard maintenance window. Reboot is required for kernel updates to take effect.

Detection guidance

Monitor kernel logs for BUG_ON() crashes originating from vmalloc() code paths invoked during display bandwidth validation or phantom plane operations. On affected systems, look for call stacks involving dcn32_validate_bandwidth(), dcn32_enable_phantom_plane(), and kvzalloc(). Kernel crash dump analysis will show the panic originating from in_interrupt() assertion failures. System uptime monitoring and unexpected reboot detection can identify exploitation attempts. This vulnerability does not leave obvious security artifacts beyond kernel panic logs.

Why prioritize this

Prioritize patching based on your use of AMD display hardware (DCN32) in production Linux systems where local users have elevated privileges. The CVSS score of 5.5 (MEDIUM) reflects the local-only attack vector and privileged access requirement, but the guaranteed denial-of-service impact warrants prompt remediation for availability-sensitive environments. Organizations running AMD-based workstations or servers with user accounts should schedule this update in the next patch cycle. The vulnerability is not remotely exploitable and does not compromise confidentiality or integrity.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (AV:L) — requires local access; Attack Complexity Low (AC:L) — no complex conditions beyond privilege level; Privileges Required (PR:L) — authenticated privileged user needed; User Interaction None (UI:N) — no user interaction required; Scope Unchanged (S:U) — impact limited to the vulnerable component; Availability Impact High (A:H) — confirmed denial of service via kernel crash; Confidentiality and Integrity Impacts are None. This rating appropriately reflects the availability risk to privileged local users without overstating the threat profile.

Frequently asked questions