Skip to main content

Linux Kernel CVE-2026-43191

| EUVDEUVD-2026-27753 MEDIUM
2026-05-06 Linux GHSA-2m7x-2cj2-wg69
Information Disclosure Linux Amd
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privilege session on DCN35 AMD system
  2. Delivery
    Trigger TMDS display disable event (disconnect HDMI/DVI or programmatic mode switch)
  3. Exploit
    Thread pre-empted during non-atomic PHY FSM PLL_ON transition
  4. Execution
    OTG remains stuck, HUBP appears active without global sync
  5. Persist
    DCHVM stalls on IOMMU invalidation ACK
  6. Impact
    System hangs

Vulnerability Assessment

Exploitation Conditions

Exploitation requires: (1) AMD DCN35-class display hardware present in the system; (2) a TMDS output (HDMI or DVI) actively configured and connected; (3) a display disable or reconfiguration event that traverses the PHY FSM TX_EN-to-PLL_ON transition path - such as monitor disconnection or a programmatic mode switch; (4) local access with at least low-level privileges (PR:L per CVSS). The hang is timing-dependent due to the non-atomic FSM transition, making it potentially intermittent. Remote exploitation is not possible (AV:L). Systems without DCN35 AMD hardware, systems using only DisplayPort or eDP outputs, and systems running patched kernel versions (≥6.19.6 or ≥7.0) are not affected.
Impact

The CVSS 5.5 Medium score (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately reflects the limited blast radius: purely local, availability-only impact with no confidentiality or integrity consequences. EPSS at 0.02% (5th percentile) confirms negligible automated or opportunistic exploitation interest. The vulnerability is absent from CISA KEV and no POC code is referenced. The 'Information Disclosure' tag appearing in ENISA EUVD metadata is inconsistent with the CVSS confidentiality metric (C:N) and the technical description, which describes only a hang condition - this tag should be disregarded as likely erroneous auto-tagging. Real-world risk is further bounded by hardware specificity: only systems running DCN35-class AMD display silicon with TMDS-connected outputs (HDMI/DVI) are susceptible. Systems using DisplayPort or eDP exclusively are not in scope. Overall this is a low operational priority unless the environment is specifically AMD DCN35-based desktop or workstation hardware where display reliability is critical.
Exploit ScenarioDerived

A local user with standard (low-privilege) access on a laptop or desktop equipped with an AMD DCN35 APU - such as certain Ryzen 7000-series platforms - disconnects an HDMI monitor or issues a programmatic display reconfiguration that disables TMDS output. Under specific timing conditions, the kernel thread executing the PHY FSM transition is pre-empted before the PLL_ON state is atomically set, leaving the OTG stuck. The DCHVM's IOMMU invalidation acknowledgment stalls indefinitely, hanging the system. No exploit code is known to exist; this scenario most likely manifests as an intermittent hang during ordinary display hot-plug events.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.

RemediationAI

Upgrade to Linux kernel 6.19.6 or 7.0, both of which contain the backported atomic PHY FSM fix. The upstream patch commits are available at https://git.kernel.org/stable/c/75372d75a4e23783583998ed90d5009d555850da (stable) and https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51 (mainline). Red Hat and SUSE users should monitor their respective security advisory channels for kernel errata incorporating these commits. If immediate kernel upgrade is not feasible and the system uses DCN35 AMD hardware, consider restricting display configuration changes by unprivileged users via udev rules or by limiting access to DRM device nodes - note this trade-off significantly impacts desktop usability. Alternatively, avoiding TMDS-connected monitors (HDMI/DVI) and using DisplayPort exclusively removes the vulnerable code path, though this may not be practical. No patch-free fix eliminates the underlying race condition.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <75372d75a4e23783583998ed99d5009d555850da
Linux patch: 6.19.6
Linux patch: 7.0
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability is located in the AMD Display Core Next 35 (DCN35) driver within the Linux kernel DRM subsystem (drivers/gpu/drm/amd/display). DCN35 is the display engine used in certain AMD Ryzen APU and GPU products. TMDS (Transition Minimized Differential Signaling) is the physical-layer protocol underlying HDMI and DVI outputs. The PHY Finite State Machine (FSM) manages power states for the display PHY; during TMDS disable, the driver incorrectly powers down the PHY PLL before the Output Timing Generator (OTG) completes its shutdown sequence. The stuck OTG causes the Display Controller Hub Virtual Memory (DCHVM) to stall while waiting to acknowledge IOMMU cache invalidations - it believes the Hub Prefetcher (HUBP) is still active but the HUBP is not receiving global synchronization. The non-atomic nature of the FSM transition means a thread pre-emption or IOMMU watchdog timeout can lock the display pipeline. The fix is a backport of the atomic PHY FSM logic from the DCN401 driver, with an adjustment to exclude eDP-specific paths that differ between DCN401 and DCN35. No CWE has been assigned by NVD, though the root cause class is consistent with a concurrency/race condition (analogous to CWE-362).

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access with low privileges needed to trigger display reconfiguration; race condition causes hang with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 11, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35

[Why] A backport of the change made for DCN401 that addresses an issue where we turn off the PHY PLL when disabling TMDS output, which causes the OTG to remain stuck.

The OTG being stuck can lead to a hang in the DCHVM's ability to ACK invalidations when it thinks the HUBP is still on but it's not receiving global sync.

The transition to PLL_ON needs to be atomic as there's no guarantee that the thread isn't pre-empted or is able to complete before the IOMMU watchdog times out.

[How] Backport the implementation from dcn401 back to dcn35.

There's a functional difference in when the eDP output is disabled in dcn401 code so we don't want to utilize it directly.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
Medium
Linux widespread, but impact scoped to AMD DCN35 desktop/laptop hardware
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43191 ADVISORY https://vuldb.com/vuln/361466 REF https://git.kernel.org/stable/c/02b033e18e08a1d0b53cf540196688c82af60a2f REF https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da REF https://git.kernel.org/stable/c/be43c36ac13d3a158791566c9fe60511022b7a15 REF https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy