{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98785", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.370Z", "datePublished": "2026-10-18T15:48:22.111Z", "dateUpdated": "2026-10-21T12:56:59.437Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:56:59.437Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check dc_state_create_copy() for NULL in dm_suspend\n\ndc_state_create_copy() can return NULL on allocation failure.\ndm_suspend() only conditionally skips dm_gpureset_toggle_interrupts()\nand continues execution, returning success. dm_resume() then\ndereferences the NULL cached_dc_state in link_enc_cfg_copy() and the\nfollowing dc_state->stream_count loop, crashing during GPU reset\nrecovery.\n\nReturn -ENOMEM immediately if the copy fails, so the caller aborts\nsuspend instead of leaving a NULL cached state for resume.\n\n(cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab)"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"], "versions": [{"version": "4cc2a94d96caeb3c975acdae7351c2f997c32175", "lessThan": "29302964ef583f3a57efc3c990bc0a71337bd3a4", "status": "affected", "versionType": "git"}, {"version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "lessThan": "686baa1f4ec43b33e39e3d4b4a4539a91d17e883", "status": "affected", "versionType": "git"}, {"version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "lessThan": "197946faa1b7968046ba475ae2f266847c6f51ed", "status": "affected", "versionType": "git"}, {"version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "lessThan": "7283b78ca07ce491984a63f6288f3f8de5bdcb22", "status": "affected", "versionType": "git"}, {"version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "lessThan": "015e72cde567d2450e282c2790773463156b2d0a", "status": "affected", "versionType": "git"}, {"version": "ea000e4b4ee5363997715531cb3d024b4e5d561c", "status": "affected", "versionType": "git"}, {"version": "d0b8b23b9c2ebec693a36fea518d8f13493ad655", "status": "affected", "versionType": "git"}, {"version": "83c7f509ef087041604e9572938f82e18b724c9d", "status": "affected", "versionType": "git"}, {"version": "1686675405d07f35eae7ff3d13a530034b899df2", "status": "affected", "versionType": "git"}, {"version": "6.6.46", "lessThan": "6.6.160", "status": "affected", "versionType": "semver"}, {"version": "5.10.258", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.165", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.105", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.10.5", "lessThan": "6.11", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.46", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/29302964ef583f3a57efc3c990bc0a71337bd3a4"}, {"url": "https://git.kernel.org/stable/c/686baa1f4ec43b33e39e3d4b4a4539a91d17e883"}, {"url": "https://git.kernel.org/stable/c/197946faa1b7968046ba475ae2f266847c6f51ed"}, {"url": "https://git.kernel.org/stable/c/7283b78ca07ce491984a63f6288f3f8de5bdcb22"}, {"url": "https://git.kernel.org/stable/c/015e72cde567d2450e282c2790773463156b2d0a"}], "title": "drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "29302964ef583f3a57efc3c990bc0a71337bd3a4", "status": "affected", "version": "4cc2a94d96caeb3c975acdae7351c2f997c32175", "versionType": "git"}, {"lessThan": "686baa1f4ec43b33e39e3d4b4a4539a91d17e883", "status": "affected", "version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "versionType": "git"}, {"lessThan": "197946faa1b7968046ba475ae2f266847c6f51ed", "status": "affected", "version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "versionType": "git"}, {"lessThan": "7283b78ca07ce491984a63f6288f3f8de5bdcb22", "status": "affected", "version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "versionType": "git"}, {"lessThan": "015e72cde567d2450e282c2790773463156b2d0a", "status": "affected", "version": "8092aa3ab8f7b737a34b71f91492c676a843043a", "versionType": "git"}, {"status": "affected", "version": "ea000e4b4ee5363997715531cb3d024b4e5d561c", "versionType": "git"}, {"status": "affected", "version": "d0b8b23b9c2ebec693a36fea518d8f13493ad655", "versionType": "git"}, {"status": "affected", "version": "83c7f509ef087041604e9572938f82e18b724c9d", "versionType": "git"}, {"status": "affected", "version": "1686675405d07f35eae7ff3d13a530034b899df2", "versionType": "git"}, {"lessThan": "6.6.160", "status": "affected", "version": "6.6.46", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.258", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.165", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.105", "versionType": "semver"}, {"lessThan": "6.11", "status": "affected", "version": "6.10.5", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: check dc_state_create_copy() for NULL in dm_suspend\n\ndc_state_create_copy() can return NULL on allocation failure.\ndm_suspend() only conditionally skips dm_gpureset_toggle_interrupts()\nand continues execution, returning success. dm_resume() then\ndereferences the NULL cached_dc_state in link_enc_cfg_copy() and the\nfollowing dc_state->stream_count loop, crashing during GPU reset\nrecovery.\n\nReturn -ENOMEM immediately if the copy fails, so the caller aborts\nsuspend instead of leaving a NULL cached state for resume.\n\n(cherry picked from commit 84b6d7932fdd2857795a257f9f258562a3cddcab)"}], "id": "CVE-2026-98785", "lastModified": "2026-10-21T13:21:46.583", "metrics": {}, "published": "2026-10-18T16:17:32.467", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/015e72cde567d2450e282c2790773463156b2d0a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/197946faa1b7968046ba475ae2f266847c6f51ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/29302964ef583f3a57efc3c990bc0a71337bd3a4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/686baa1f4ec43b33e39e3d4b4a4539a91d17e883"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7283b78ca07ce491984a63f6288f3f8de5bdcb22"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend", "id": "2555103", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555103"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's AMD display driver. During power management suspend operations under low memory conditions, the driver fails to handle memory allocation failures and retains an invalid null state. When the system subsequently attempts to resume or recover the graphics processor, it dereferences this null pointer, resulting in a kernel crash and a Denial of Service (DoS)."], "name": "CVE-2026-98785", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98785\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98785\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98785.mbox"], "threat_severity": "Moderate"}