Skip to main content

Linux Kernel CVE-2026-43191

| EUVDEUVD-2026-27753 MEDIUM
2026-05-06 Linux GHSA-2m7x-2cj2-wg69
Information Disclosure Linux Amd
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges needed to trigger display reconfiguration; race condition causes hang with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:05 vuln.today
CVSS changed
May 11, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35

[Why] A backport of the change made for DCN401 that addresses an issue where we turn off the PHY PLL when disabling TMDS output, which causes the OTG to remain stuck.

The OTG being stuck can lead to a hang in the DCHVM's ability to ACK invalidations when it thinks the HUBP is still on but it's not receiving global sync.

The transition to PLL_ON needs to be atomic as there's no guarantee that the thread isn't pre-empted or is able to complete before the IOMMU watchdog times out.

[How] Backport the implementation from dcn401 back to dcn35.

There's a functional difference in when the eDP output is disabled in dcn401 code so we don't want to utilize it directly.

AnalysisAI

System hang vulnerability in the AMD DCN35 display engine driver allows a local low-privilege user to trigger an unrecoverable kernel hang by initiating a TMDS display disable event on affected AMD hardware. The hang arises because the PHY FSM transition from TX_EN to PLL_ON is non-atomic, leaving the Output Timing Generator stuck and blocking DCHVM IOMMU invalidation acknowledgments - a condition that can arise under normal display reconfiguration. No public exploit code exists and EPSS is 0.02% (5th percentile), indicating no meaningful exploitation interest; the CISA KEV does not list this vulnerability.

Technical ContextAI

The vulnerability is located in the AMD Display Core Next 35 (DCN35) driver within the Linux kernel DRM subsystem (drivers/gpu/drm/amd/display). DCN35 is the display engine used in certain AMD Ryzen APU and GPU products. TMDS (Transition Minimized Differential Signaling) is the physical-layer protocol underlying HDMI and DVI outputs. The PHY Finite State Machine (FSM) manages power states for the display PHY; during TMDS disable, the driver incorrectly powers down the PHY PLL before the Output Timing Generator (OTG) completes its shutdown sequence. The stuck OTG causes the Display Controller Hub Virtual Memory (DCHVM) to stall while waiting to acknowledge IOMMU cache invalidations - it believes the Hub Prefetcher (HUBP) is still active but the HUBP is not receiving global synchronization. The non-atomic nature of the FSM transition means a thread pre-emption or IOMMU watchdog timeout can lock the display pipeline. The fix is a backport of the atomic PHY FSM logic from the DCN401 driver, with an adjustment to exclude eDP-specific paths that differ between DCN401 and DCN35. No CWE has been assigned by NVD, though the root cause class is consistent with a concurrency/race condition (analogous to CWE-362).

RemediationAI

Upgrade to Linux kernel 6.19.6 or 7.0, both of which contain the backported atomic PHY FSM fix. The upstream patch commits are available at https://git.kernel.org/stable/c/75372d75a4e23783583998ed90d5009d555850da (stable) and https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51 (mainline). Red Hat and SUSE users should monitor their respective security advisory channels for kernel errata incorporating these commits. If immediate kernel upgrade is not feasible and the system uses DCN35 AMD hardware, consider restricting display configuration changes by unprivileged users via udev rules or by limiting access to DRM device nodes - note this trade-off significantly impacts desktop usability. Alternatively, avoiding TMDS-connected monitors (HDMI/DVI) and using DisplayPort exclusively removes the vulnerable code path, though this may not be practical. No patch-free fix eliminates the underlying race condition.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43191 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy