CVE-2026-68236

A flaw was found in the Linux kernel's drm/amd/display component. Specifically, within the dm_update_crtc_state() function, a stream pointer is released but not subsequently set to NULL. This can lead to a double release of the same pointer if an error occurs later in the process, creating a use-after-free vulnerability. This issue could potentially lead to memory corruption or a denial of service.

This vulnerability is rated as having an Important impact because a local user could trigger a use-after-free condition leading to kernel memory corruption or potential privilege escalation. Exploitation requires the amdgpu driver to be actively handling display state operations on AMD graphics hardware. Headless systems and deployments lacking AMD display adapters are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue on systems that do not require AMD graphics hardware, prevent the amdgpu module from loading:

1. Create a configuration file in /etc/modprobe.d to disable the driver:

echo "install amdgpu /bin/true" > /etc/modprobe.d/disable-amdgpu.conf

2. If the amdgpu module is already loaded in the running kernel, a system reboot is required for the configuration to take effect.

Warning: Disabling this module prevents the initialization of AMD graphics adapters, which disables graphical desktop environments, display output, and GPU acceleration on systems relying on AMD hardware.