CVE-2026-89819

7.8 HIGH

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: This vulnerability allows a malicious user to cause a divide-by-zero error or out-of-bounds read in the Linux kernel by providing a malformed AMD_PLANE_DEGAMMA_LUT property, potentially leading to a denial of service or other kernel crashes.
Exploitability: Exploitation requires a user with the ability to set the AMD_PLANE_DEGAMMA_LUT property, which is typically limited to specific applications or users with direct access to the display configuration.
Blast radius: If exploited, the vulnerability could lead to a denial of service for the affected display subsystem, potentially impacting the stability of the entire system.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Disable the AMD_PLANE_DEGAMMA_LUT property or ensure that only valid LUT sizes are used.

doskerneldisplaymalformed-input

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: validate plane degamma LUT size for private color prop Unlike the CRTC degamma path, which is guarded by amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never validated before use. __set_dm_plane_degamma() passed the user-supplied size straight into __is_lut_linear() and, for a non-linear LUT, into __set_input_tf() -> __drm_lut_to_dc_gamma(), the latter always iterating MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size. A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in __drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already asserts a few lines below (and which the CRTC path enforces). The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with AMD_PRIVATE_COLOR defined.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.