Linux Kernel CVE-2026-93175

Requires local access to the AMD GPU (amdgpu) DRM device and the ability to invoke CRTC/atomic reset paths that call amdgpu_dm_crtc_reset_state(). The dangling pointer only arises when kzalloc() fails during that reset - i.e., under kernel memory exhaustion - so exploitation is gated on inducing an allocation failure at the precise moment, which is not reliably attacker-controllable. Limited to systems using AMD GPUs with the amdgpu display stack; no remote vector, and realistic outcome is a kernel crash rather than code execution or data disclosure.

This is a low-real-world-risk issue despite the vendor's 7.8 CVSS. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H claims high confidentiality/integrity/availability impact via local, low-privilege, low-complexity access, but this contradicts the actual defect: a dangling pointer that only manifests when kzalloc() fails inside amdgpu_dm_crtc_reset_state(). Allocation failure is not attacker-controllable in any reliable way (it requires kernel memory exhaustion), so realistic AC is High and the practical impact is a crash/use-after-free rather than a controllable read/write primitive - the vendor's C:H/I:H is not supported by the description. No EPSS score, no CISA KEV listing, and no public exploit are provided; the flaw was found internally by the Linux Verification Center via SVACE static analysis, indicating a code-quality/hardening fix rather than an observed attack. Signals conflict: vendor CVSS is high but every corroborating exploitation signal (EPSS/KEV/POC) is absent or negative, consistent with a defensively-patched error path, not a priority threat. The 'Information Disclosure' tag is not supported - there is no disclosure path; the outcome is denial of service.

A local user repeatedly triggers CRTC atomic reset (e.g., modeset/DRM ioctls) while the system is under severe memory pressure so that kzalloc() fails during amdgpu_dm_crtc_reset_state(); the CRTC state pointer is then left dangling at freed memory. A subsequent DRM operation dereferences the freed state, causing a use-after-free that most likely crashes the machine. No public exploit exists and reliable triggering of the allocation failure is impractical.