CVE-2026-98786

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: guard dc_sink dereferences in MST mode validation

dm_dp_mst_is_port_support_mode() reads

aconnector->dc_sink->dsc_caps... for the DSC branch-throughput check,

and get_conv_frl_bw()'s HDMI-PCON FRL-bandwidth path reads

aconnector->dc_sink->edid_caps.max_frl_rate, both without a NULL

check. dc_sink is cleared asynchronously on MST unplug, and both

functions run from paths that the driver's own comments document as

racing that teardown: the connector probe worker's ->mode_valid

callback and a compositor's atomic check, neither of which holds the

MST manager lock that the teardown path uses. The former does have an

existing dsc_aux NULL check, but dsc_aux isn't reliably cleared in

every path that clears dc_sink, so it doesn't cover this.

Fail the port-support check and skip the FRL conversion path when the

sink is already gone.

(cherry picked from commit 7c3db8da4e039698ae198c870712428644e965c7)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References