Skip to main content

Linux Kernel CVE-2026-53285

| EUVDEUVD-2026-39890 MEDIUM
Reachable Assertion (CWE-617)
2026-06-26 Linux GHSA-hwwg-2jmx-c78q
Denial Of Service Linux Amd
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain low-privilege local shell on AMD RDNA3 system
  2. Delivery
    Trigger display mode change invoking phantom-plane validation
  3. Exploit
    DC_FP_START disables softirqs via fpregs_lock
  4. Execution
    kvzalloc escalates to vmalloc within locked region
  5. Persist
    BUG_ON(in_interrupt()) assertion fires
  6. Impact
    Kernel panic and system crash

Vulnerability Assessment

Weakness
CWE
CWE-617
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
Exploitation Conditions

Exploitation requires local, low-privileged access to a machine running the Linux kernel with an AMD DCN32 (RDNA3-generation) GPU, on an x86 non-RT kernel build. The crash is triggered specifically when dcn32_validate_bandwidth() is called while the DML1 phantom-plane path is active - this occurs during display validation (e.g., when configuring or changing display modes involving phantom planes). Exploitation is limited by: (1) hardware specificity - only AMD RDNA3/DCN32 display hardware is affected; (2) the x86 non-RT kernel requirement - RT kernel variants handle FPU locking differently and would not trigger the crash; (3) local access (CVSS PR:L) - a remote attacker cannot reach this code path without first obtaining a local shell. The impact is kernel crash only; no privilege escalation or data access is possible.
Impact

Real-world risk is moderate-to-low despite the hardware-crashing outcome. The CVSS vector (AV:L/AC:L/PR:L) correctly reflects that exploitation is local and requires low privileges, meaning an attacker must already have a shell on the target machine. The impact is purely an availability denial (A:H) with no confidentiality or integrity component, limiting attacker utility to disruption. EPSS at 0.15% in the 5th percentile reinforces that exploitation interest is minimal and the vulnerability is not being scanned for broadly. The absence of a CISA KEV listing and no reported POC further reduce urgency. The biggest real-world limitation is hardware specificity: only systems with AMD DCN32 (RDNA3) GPUs are reachable, significantly narrowing the affected population. This is a genuine stability defect relevant to AMD GPU workstations and servers running display workloads, but not a vector for privilege escalation or data exfiltration. Patch availability on stable trees 7.0.10 and 7.1 makes remediation straightforward.
Exploit ScenarioDerived

A local user on a workstation or server equipped with an AMD RDNA3 GPU (DCN32 hardware) triggers a display-related operation that causes the kernel to invoke dcn32_validate_bandwidth() with the phantom-plane path active. The kvzalloc() call within the softirq-disabled FPU region fires BUG_ON(in_interrupt()), crashing the kernel and causing a full system reboot, resulting in denial of service. No public exploit or proof-of-concept code has been identified at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 08, 2026

Kernel crash in Linux DRM/AMD DCN32 display subsystem affects systems equipped with AMD RDNA3-generation GPUs running x86 non-RT kernels. The dcn32_validate_bandwidth() function locks FPU registers via DC_FP_START(), disabling local softirqs, then calls kvzalloc() for a ~335 KiB phantom-plane allocation that triggers the vmalloc path; vmalloc fires BUG_ON(in_interrupt()), crashing the kernel. No public exploit has been identified at time of analysis, and EPSS at 0.15% (5th percentile) reflects low real-world exploitation interest.

RemediationAI

Upgrade to Linux kernel 7.0.10 or 7.1, where the fix wraps the dc_state_create_phantom_plane() call with DC_RUN_WITH_PREEMPTION_ENABLED() to permit preemption during the kvzalloc() allocation, preventing the BUG_ON assertion from firing. Fix commits are documented at https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6 and https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6. For systems that cannot be patched immediately, a compensating control is to avoid display configurations that invoke the DML1 phantom-plane allocation path on DCN32 hardware - for example, by disabling multi-display or power-saving phantom-plane features if the driver exposes a sysfs/udev knob; however, this is not universally configurable and may affect display functionality. Running an RT (real-time) kernel variant bypasses the fpregs_lock()-based softirq disabling entirely and would avoid the crash, but introduces its own performance trade-offs and is not a standard production choice for most workloads.

Affected VersionsENISA

Linux 235c67634230b0f9ad8c0185272fed36c892b1c4 <30bb2ec6695d62f63db4aa6179c4626834ed0cd6
Linux 6.0
Linux patch: 7.0.10
Linux 235c67634230b0f9ad8c0185272fed36c892b1c4 <183182235f6d53bac62c6c39014738a54a68dfa6
Linux patch: 7.1
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected code resides in the Linux kernel DRM subsystem's AMD display stack, specifically the DCN32 (Display Core Next generation 32) bandwidth validation path used with AMD RDNA3-class display hardware. CWE-617 (Reachable Assertion) is the root cause: the DC_FP_START() macro acquires fpregs_lock() on x86 non-RT kernels, which disables local softirqs. Within this protected region, dcn32_enable_phantom_plane() calls kvzalloc() requesting approximately 335 KiB for a dc_plane_state struct. Because the requested size exceeds the kmalloc threshold, kvzalloc() escalates to the vmalloc path, which contains an unconditional BUG_ON(in_interrupt()) assertion. Since softirqs are disabled at this point, the assertion evaluates as true, immediately crashing the kernel. Affected CPE: cpe:2.3:a:linux:linux from commit 235c67634230b0f9ad8c0185272fed36c892b1c4 up to the stable-tree fix commits.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local-only vector with low-privilege trigger; pure availability impact (kernel crash); no confidentiality or integrity consequence; matches NVD-provided vector independently.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 08, 2026 - 04:07 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:40 nvd
MEDIUM 5.5
CVE Published
Jun 26, 2026 - 19:40 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED

[Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs.

The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash.

[How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation.

(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Medium
Linux kernel ubiquitous but DCN32 hardware-gated, narrowing scope
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2021-27212 HIGH POC
7.5
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2026-27135 HIGH POC
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.177 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.155 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.206 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.152 Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53285 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/374397 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22742/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22769/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6 REF https://git.kernel.org/stable/c/19e82047cb68bcde55791ee20178acd431609b8d REF https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6 REF https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy