CVE-2026-53285

Source
https://cve.org/CVERecord?id=CVE-2026-53285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-53285
Downstream
AZL (1)
BELL (1)
CGA (41)
DEBIAN (1)
OESA (2)
openSUSE (1)
ROOT (3)
SUSE (10)
UBUNTU (1)
Related
Published
2026-06-26T19:40:46Z
Modified
2026-10-28T02:31:02Z
Summary
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED

[Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs.

The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash.

[How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation.

(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53285.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
235c67634230b0f9ad8c0185272fed36c892b1c4
Fixed
19e82047cb68bcde55791ee20178acd431609b8d
Fixed
a8c1480bb066cf0f6e79129b7292e1c99ff68b9b
Fixed
30bb2ec6695d62f63db4aa6179c4626834ed0cd6
Fixed
183182235f6d53bac62c6c39014738a54a68dfa6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53285.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.57
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.10

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53285.json"