Acknowledged
Created: Dec 16, 2025
Updated: Dec 18, 2025
Found In Version: 10.23.30.1
Severity: Standard
Applicable for: Wind River Linux LTS 23
Component/s: Kernel
In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]drm/amd/display: Check NULL before accessing[EOL][EOL][WHAT][EOL]IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic[EOL]fails with NULL pointer dereference. This can be reproduced with[EOL]both an eDP panel and a DP monitors connected.[EOL][EOL] BUG: kernel NULL pointer dereference, address: 0000000000000000[EOL] #PF: supervisor read access in kernel mode[EOL] #PF: error_code(0x0000) - not-present page[EOL] PGD 0 P4D 0[EOL] Oops: Oops: 0000 [#1] SMP NOPTI[EOL] CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted[EOL]6.16.0-99-custom #8 PREEMPT(voluntary)[EOL] Hardware name: AMD ........[EOL] RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu][EOL] Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49[EOL] 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30[EOL] c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02[EOL] RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292[EOL] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668[EOL] RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000[EOL] RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760[EOL] R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000[EOL] R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c[EOL] FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)[EOL]knlGS:0000000000000000[EOL] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033[EOL] CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0[EOL] PKRU: 55555554[EOL] Call Trace:[EOL] <TASK>[EOL] dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu][EOL] amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu][EOL] ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu][EOL] amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu][EOL] drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400[EOL] drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30[EOL] drm_crtc_get_last_vbltimestamp+0x55/0x90[EOL] drm_crtc_next_vblank_start+0x45/0xa0[EOL] drm_atomic_helper_wait_for_fences+0x81/0x1f0[EOL] ...[EOL][EOL](cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)