CVE-2026-80704 (GCVE-0-2026-80704)
Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
EPSS
VEX
Title
drm/amd/display: use proper context for logging
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use proper context for logging
The same as the rest of the code, get_ss_info_from_atombios() uses
calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is
initialized only later in calc_pll_max_vco_construct(). Therefore, any
output using DC_LOG_SYNC() leads to a NULL pointer deference in
get_ss_info_from_atombios().
According to Sashiko, the very same problem exists in
dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
To avoid accessing the NULL context, use clk_src->base.ctx->logger
everywhere. That context in base is initialized earlier in
dce110_clk_src_construct() and dce112_clk_src_construct(). Before
get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions
above are actually called. This is done by redefining DC_LOGGER to
CTX->logger.
Before:
dce110_clk_src_construct() did:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM
-> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
After:
dce110_clk_src_construct() does:
-> sets clk_src->base.ctx = ctx;
-> ss_info_from_atombios_create()
-> get_ss_info_from_atombios() <- uses clk_src->base.ctx
(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Severity
No CVSS data available.
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
1296423bf23c7a58133970e223b1f47ec6570308 , < a94e62b7c7018fcfe0251e53fa96af30f12d923a
(git)
Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 02647d98340738f918690ed227fdcf154db1b84a (git) Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < f556bc844cc4423e5ad41ae41a4c24f1cf75b978 (git) Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 114b42507b6a23d9d24e24e4ef165233332c64d4 (git) |
guessed | |
| Linux | Linux |
Affected:
4.17
Unaffected: 0 , < 4.17 (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a94e62b7c7018fcfe0251e53fa96af30f12d923a",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "02647d98340738f918690ed227fdcf154db1b84a",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "f556bc844cc4423e5ad41ae41a4c24f1cf75b978",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
},
{
"lessThan": "114b42507b6a23d9d24e24e4ef165233332c64d4",
"status": "affected",
"version": "1296423bf23c7a58133970e223b1f47ec6570308",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.103",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.44",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.8",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use proper context for logging\n\nThe same as the rest of the code, get_ss_info_from_atombios() uses\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\nget_ss_info_from_atombios().\n\nAccording to Sashiko, the very same problem exists in\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\n\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\neverywhere. That context in base is initialized earlier in\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\nabove are actually called. This is done by redefining DC_LOGGER to\nCTX-\u003elogger.\n\nBefore:\ndce110_clk_src_construct() did:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses calc_pll_cs-\u003ectx # BOOM\n -\u003e calc_pll_max_vco_construct() \u003c- sets calc_pll_cs-\u003ectx\n\nAfter:\ndce110_clk_src_construct() does:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses clk_src-\u003ebase.ctx\n\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T06:53:06.442Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a"
},
{
"url": "https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a"
},
{
"url": "https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978"
},
{
"url": "https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"
}
],
"title": "drm/amd/display: use proper context for logging",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80704",
"datePublished": "2026-08-28T06:53:06.442Z",
"dateReserved": "2026-08-26T14:34:25.786Z",
"dateUpdated": "2026-08-28T06:53:06.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80704",
"date": "2026-08-28",
"epss": "0.00159",
"percentile": "0.05383"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80704\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:55.953\",\"lastModified\":\"2026-08-28T08:16:55.953\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: use proper context for logging\\n\\nThe same as the rest of the code, get_ss_info_from_atombios() uses\\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\\nget_ss_info_from_atombios().\\n\\nAccording to Sashiko, the very same problem exists in\\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\\n\\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\\neverywhere. That context in base is initialized earlier in\\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\\nabove are actually called. This is done by redefining DC_LOGGER to\\nCTX-\u003elogger.\\n\\nBefore:\\ndce110_clk_src_construct() did:\\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\\n -\u003e ss_info_from_atombios_create()\\n -\u003e get_ss_info_from_atombios() \u003c- uses calc_pll_cs-\u003ectx # BOOM\\n -\u003e calc_pll_max_vco_construct() \u003c- sets calc_pll_cs-\u003ectx\\n\\nAfter:\\ndce110_clk_src_construct() does:\\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\\n -\u003e ss_info_from_atombios_create()\\n -\u003e get_ss_info_from_atombios() \u003c- uses clk_src-\u003ebase.ctx\\n\\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1296423bf23c7a58133970e223b1f47ec6570308\",\"lessThan\":\"a94e62b7c7018fcfe0251e53fa96af30f12d923a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1296423bf23c7a58133970e223b1f47ec6570308\",\"lessThan\":\"02647d98340738f918690ed227fdcf154db1b84a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1296423bf23c7a58133970e223b1f47ec6570308\",\"lessThan\":\"f556bc844cc4423e5ad41ae41a4c24f1cf75b978\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1296423bf23c7a58133970e223b1f47ec6570308\",\"lessThan\":\"114b42507b6a23d9d24e24e4ef165233332c64d4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…