CVE-2026-93068drm/amd/display: Fix DM I2C teardown race
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpu_dm_i2c_xfer() after the backing DM state has been torn down, leading to a NULL pointer dereference. Create a devres group around the DM I2C adapter lifetime and release it at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn down. This removes the I2C adapters first and waits for in-flight users to drain before the structures used by amdgpu_dm_i2c_xfer() disappear. This fixes a teardown ordering race seen during device removal: BUG: kernel NULL pointer dereference RIP: amdgpu_dm_i2c_xfer+0x122/0x1c0 [amdgpu] Call Trace: __i2c_transfer i2c_transfer i2cdev_ioctl_rdwr
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 before 8ee385305e8902fa6fbfd66b5a112238292567b6; from 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 before 6970ec944567f109ac4240f9aea58158ee8a18cd; from 5b3eca05cfb02ed0dbd7097c056fb08ce5f76fe3 before e4ae30a12aa95942814957d8bc1ce7366a7107d7 | CNA record |
References
- https://git.kernel.org/stable/c/8ee385305e8902fa6fbfd66b5a112238292567b6
- https://git.kernel.org/stable/c/6970ec944567f109ac4240f9aea58158ee8a18cd
- https://git.kernel.org/stable/c/e4ae30a12aa95942814957d8bc1ce7366a7107d7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.