CVE-2026-90035

A flaw was found in the drm/amd/display component of the Linux kernel. A local attacker, by connecting a specially crafted USB4/DPIA tunneling device, could trigger a division-by-zero error within the get_estimated_bw() function. This occurs when the device reports an estimated-bandwidth change before a capability change, leading to an attempt to divide by zero in a critical kernel operation. Successful exploitation of this vulnerability could lead to a system crash, resulting in a Denial of Service (DoS).

This vulnerability is classified as having a Low severity impact because triggering the condition requires local physical access to attach an external USB4 or DisplayPort adapter to an AMD GPU-enabled system, and successful exploitation only induces an operating system crash. Enterprise server environments typically do not utilize external display tunneling interfaces or AMD graphics drivers, substantially limiting exposure across standard Red Hat Enterprise Linux deployments. Furthermore, the issue only presents a risk of denial of service without compromising system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.