Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 and mvmpg_width/height == 0. This will cause a divide-by-zero panic and can also cause an underflow on num_mcaches. Fix this by changing calculate_mcache_setting to bool and adding guards after each calculate_mcache_row_bytes call. If num_mcaches or mvmpg_width/height is zero, return a false. Callers will propagate the failure as a rejected mode, which prevents the panic. (cherry picked from commit 29c0f7c655f47bcbd575ff75e58480df6ec3c9da)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:49.500Z",
  "pubdate": "2026-08-15T13:17:49.500Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel within the Direct Rendering Manager (DRM) subsystem for AMD displays, specifically in the calculate_mcache_setting function. The vulnerability is classified as a divide-by-zero flaw that can lead to a kernel panic and a potential integer underflow on num_mcaches. The affected product is the Linux kernel utilizing the drm/amd/display component. The risk implication includes localized denial of service via system crashes triggered by unhandled zero-area viewports during display mode configuration. Attacker capabilities require the ability to interact with the display subsystem or configure specific display modes that result in zero-area viewports. Exploitation requirements involve supplying a plane configuration where the viewport dimensions evaluate to zero, forcing the vulnerable function to process invalid geometric parameters.",
  "technicalDetails": "The vulnerability resides in the calculate_mcache_setting function within the drm/amd/display component of the Linux kernel. The root cause of the issue stems from insufficient input validation when handling plane viewports. Specifically, if a plane reaches calculate_mcache_setting with a zero-area viewport, the function previously exited early while leaving variables such as num_mcaches and mvmpg_width/height set to zero. This state subsequently triggers a divide-by-zero arithmetic exception during subsequent calculations dependent on these metrics, leading directly to a kernel panic. Additionally, this zero state can cause an integer underflow on the num_mcaches variable.\nThe step-by-step attack flow involves an actor or application configuring a display mode or plane with a zero-area viewport. When the display driver executes the calculate_mcache_setting routine, it encounters the zero-dimension parameters. Due to the absence of adequate guards following the calculate_mcache_row_bytes calls, the execution flow proceeds with zero values for critical variables like mvmpg_width, mvmpg_height, and num_mcaches. Subsequent arithmetic operations utilizing these variables result in a hardware-level or software-level divide-by-zero trap, halting the kernel and causing a denial of service.\nThe vulnerable component is the display configuration and memory cache setting logic implemented in the AMD display driver. The affected versions encompass Linux kernel distributions containing the vulnerable display driver code prior to the application of the corrective patch. Authentication and privilege requirements depend on the local system environment's access controls for rendering and display management APIs, typically requiring local access or specific permissions to configure display modes. The payload behavior is entirely systemic, manifesting as an unhandled exception causing kernel termination rather than arbitrary code execution."
}