CVE-2026-98313

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: skip PUSH_IDLE when the link was never enabled

msm_dp_display_atomic_enable() returns early when link training fails,

leaving ->power_on false and the main link down.

msm_dp_display_atomic_disable() nevertheless writes DP_STATE_CTRL_PUSH_IDLE

and waits for an idle-pattern completion that cannot arrive, so every failed

enable is followed by "PUSH_IDLE pattern timedout".

Every other step of the teardown is already gated on that flag:

msm_dp_display_disable(), called from .atomic_post_disable(), returns early

on !power_on. The PUSH_IDLE write is the only one that is not, so the

controller's runtime-PM reference is then dropped without the link having

been taken down.

On glymur (Snapdragon X2 Elite) the consequence is not a warning. The SoC

does not survive it: TrustZone force-stops the SOCCP and ADSP remote

processors and the machine resets silently about 50 ms later, with no oops

and no panic. On an ASUS

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References