CVE-2026-80704 (GCVE-0-2026-80704)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:53 – Updated: 2026-08-28 06:53
VLAI
Title
drm/amd/display: use proper context for logging
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use proper context for logging The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios(). According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too. To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger. Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx (cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < a94e62b7c7018fcfe0251e53fa96af30f12d923a (git)
Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 02647d98340738f918690ed227fdcf154db1b84a (git)
Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < f556bc844cc4423e5ad41ae41a4c24f1cf75b978 (git)
Affected: 1296423bf23c7a58133970e223b1f47ec6570308 , < 114b42507b6a23d9d24e24e4ef165233332c64d4 (git)
Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a94e62b7c7018fcfe0251e53fa96af30f12d923a",
              "status": "affected",
              "version": "1296423bf23c7a58133970e223b1f47ec6570308",
              "versionType": "git"
            },
            {
              "lessThan": "02647d98340738f918690ed227fdcf154db1b84a",
              "status": "affected",
              "version": "1296423bf23c7a58133970e223b1f47ec6570308",
              "versionType": "git"
            },
            {
              "lessThan": "f556bc844cc4423e5ad41ae41a4c24f1cf75b978",
              "status": "affected",
              "version": "1296423bf23c7a58133970e223b1f47ec6570308",
              "versionType": "git"
            },
            {
              "lessThan": "114b42507b6a23d9d24e24e4ef165233332c64d4",
              "status": "affected",
              "version": "1296423bf23c7a58133970e223b1f47ec6570308",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use proper context for logging\n\nThe same as the rest of the code, get_ss_info_from_atombios() uses\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\nget_ss_info_from_atombios().\n\nAccording to Sashiko, the very same problem exists in\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\n\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\neverywhere. That context in base is initialized earlier in\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\nabove are actually called. This is done by redefining DC_LOGGER to\nCTX-\u003elogger.\n\nBefore:\ndce110_clk_src_construct() did:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n   -\u003e get_ss_info_from_atombios()   \u003c- uses calc_pll_cs-\u003ectx  # BOOM\n -\u003e calc_pll_max_vco_construct()    \u003c- sets calc_pll_cs-\u003ectx\n\nAfter:\ndce110_clk_src_construct() does:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n   -\u003e get_ss_info_from_atombios()   \u003c- uses clk_src-\u003ebase.ctx\n\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T06:53:06.442Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a"
        },
        {
          "url": "https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978"
        },
        {
          "url": "https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"
        }
      ],
      "title": "drm/amd/display: use proper context for logging",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80704",
    "datePublished": "2026-08-28T06:53:06.442Z",
    "dateReserved": "2026-08-26T14:34:25.786Z",
    "dateUpdated": "2026-08-28T06:53:06.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80704",
      "date": "2026-10-03",
      "epss": "0.00209",
      "percentile": "0.09961"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a94e62b7c7018fcfe0251e53fa96af30f12d923a",
                    "status": "affected",
                    "version": "1296423bf23c7a58133970e223b1f47ec6570308",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "02647d98340738f918690ed227fdcf154db1b84a",
                    "status": "affected",
                    "version": "1296423bf23c7a58133970e223b1f47ec6570308",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f556bc844cc4423e5ad41ae41a4c24f1cf75b978",
                    "status": "affected",
                    "version": "1296423bf23c7a58133970e223b1f47ec6570308",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "114b42507b6a23d9d24e24e4ef165233332c64d4",
                    "status": "affected",
                    "version": "1296423bf23c7a58133970e223b1f47ec6570308",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/dce/dce_clock_source.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use proper context for logging\n\nThe same as the rest of the code, get_ss_info_from_atombios() uses\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\nget_ss_info_from_atombios().\n\nAccording to Sashiko, the very same problem exists in\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\n\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\neverywhere. That context in base is initialized earlier in\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\nabove are actually called. This is done by redefining DC_LOGGER to\nCTX-\u003elogger.\n\nBefore:\ndce110_clk_src_construct() did:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n   -\u003e get_ss_info_from_atombios()   \u003c- uses calc_pll_cs-\u003ectx  # BOOM\n -\u003e calc_pll_max_vco_construct()    \u003c- sets calc_pll_cs-\u003ectx\n\nAfter:\ndce110_clk_src_construct() does:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n   -\u003e get_ss_info_from_atombios()   \u003c- uses clk_src-\u003ebase.ctx\n\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)"
          }
        ],
        "id": "CVE-2026-80704",
        "lastModified": "2026-08-28T08:16:55.953",
        "metrics": {},
        "published": "2026-08-28T08:16:55.953",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-01T08:24:17+00:00",
      "cve": "CVE-2026-80704",
      "id": "CVE-2026-80704",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: use proper context for logging",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80704.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.