CVE-2026-89773

A flaw was found in the drm/amd/display component of the Linux kernel. This vulnerability occurs because the High-bandwidth Digital Content Protection (HDCP) configuration routine is skipped during a transition state when an invalid dm_stream_ctx is present. This can lead to the HDCP routine not being properly configured, potentially allowing unauthorized access to protected content.

A low impact flaw was found in the AMD display driver (drm/amd/display) of the Linux kernel. When a display stream is in a transition state, the driver can run the HDCP (High-bandwidth Digital Content Protection) configuration routine even though the stream's dm_stream_ctx context is not valid at that point. A local user with low privileges who is able to trigger such a display state transition on an affected system could cause the kernel to crash, resulting in a denial of service; the impact is limited to availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced upstream in Linux kernel 7.2 and is not present in the kernel and kernel-rt builds of supported Red Hat Enterprise Linux releases, which are therefore not affected. Within OpenShift Container Platform, only the RHEL CoreOS 9 kernel shipped with OpenShift 5.0 and 5.1 is affected. The fix for these streams is currently deferred; the residual risk of the deferral is limited to a local denial of service on affected nodes, consistent with the low severity of this flaw. All other OpenShift Container Platform releases are not affected because the vulnerable code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.