CVE-2026-74449

A flaw was found in the display driver component of the Linux kernel. A local attacker could exploit a vulnerability related to how the system handles display settings, specifically when processing certain display configurations. This could lead to a system crash, resulting in a Denial of Service (DoS) for the affected system.

A flaw of moderate impact was found in the AMD display driver (drm/amd/display) of the Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernels. When a plane with a zero-area viewport reaches calculate_mcache_setting(), the function returns with num_mcaches and mvmpg_width/mvmpg_height equal to zero, which triggers a divide-by-zero kernel panic and can also cause an integer underflow on num_mcaches. A local attacker with access to the DRM/KMS subsystem, for example a regular user able to submit display mode or plane configurations, could use a crafted display configuration to crash the kernel, resulting in a denial of service. There is no impact to confidentiality or integrity. Red Hat therefore rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the CVE.org score of 7.8 because the CVE.org vector assumes high confidentiality and integrity impact, while this divide-by-zero and integer-underflow flaw only affects availability. The affected components are the kernel and kernel-rt packages across Red Hat Enterprise Linux 7 through 10 update streams and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2; fixes for these streams are currently deferred, so the residual risk of a local denial of service remains until they are addressed. Red Hat Enterprise Linux 6 ELS is out of support scope for this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.