PT-2026-34393 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31488

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the amdgpu component where the mode changed flag is incorrectly reset to false during DSC (Display Stream Compression) validation when recomputing the configuration results in no timing change for a specific stream. This occurs in scenarios where a change in MST/DSC configuration happens in the same KMS commit as an unrelated mode change. Consequently, dm update crtc state() creates new streams for CRTCs with DSC-independent mode changes, but amdgpu dm commit streams() fails to release the old stream, leading to a memory leak. Additionally, amdgpu dm atomic commit tail() does not acquire a reference to the new stream, which results in a use-after-free condition when the stream is later disabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31488

Affected Products

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-31488 · Security Note
• https://git.kernel.org/stable/c/8a5edc97fd9c6415ff2eff872748439a97e3c3d8 · Note
• https://git.kernel.org/stable/c/111208b5b7ebcdadb3f922cc52d8425f0fa91b33 · Note
• https://twitter.com/CVEnew/status/2046979992085500179 · Twitter Post
• https://git.kernel.org/stable/c/10862e344b4d6434642a48c87d765813fc0b0ba7 · Note
• https://git.kernel.org/stable/c/aed3d041ab061ec8a64f50a3edda0f4db7280025 · Note