CVE-2026-93176

A flaw was found in the Linux kernel's AMD display (drm/amd/display) driver. Specifically, the amdgpu_dm_plane_drm_plane_reset() function attempts to free memory before successfully allocating a new state. Should the new memory allocation fail, a dangling pointer to the previously freed memory remains. This condition can lead to memory corruption, potentially allowing a local attacker to impact system stability or integrity.

A use after free risk exists in the AMDGPU display plane reset path because amdgpu_dm_plane_drm_plane_reset freed the old drm plane state before allocating the replacement state. If kzalloc failed, the function returned while plane state still pointed to freed memory, leaving a dangling pointer that later DRM atomic or display code could dereference or free again. For the CVSS the PR:L is used for the paranoid score because a local user with access to DRM or KMS control paths may be able to influence modeset, display reset, hotplug, resume, or recovery behavior without full administrator privileges. The issue is not network reachable. Impact is at least local denial of service through a kernel crash. In the worst defensible case it may allow confidentiality and integrity impact because the bug is a real kernel use after free condition rather than a pure NULL dereference or resource leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.