CVE-2026-80542

A NULL pointer dereference flaw in the drm/amd/display driver of the Linux kernel can lead to a kernel panic and denial of service, and is rated Moderate by Red Hat Product Security. The amdgpu_dm_crtc_set_vblank() function dereferences acrtc_state->stream when vblank is enabled or queried through the DRM_IOCTL_MODE_CRTC_GET_SEQUENCE ioctl before a display stream has been attached to the CRTC. A local attacker with access to the DRM subsystem, for example a user able to run graphics workloads on an affected system, can trigger this path and cause a kernel NULL pointer dereference and full system crash. There is no impact on confidentiality or integrity, which is reflected in the Red Hat CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). This flaw affects the kernel and kernel-rt components in Red Hat Enterprise Linux 9 (rhel-9.8.z, rhel-9.9, and rhel-9.10) and Red Hat Enterprise Linux 10 (rhel-10.2.z, rhel-10.3, and rhel-10.4), as well as the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2.0 and 2.1. Other Red Hat Enterprise Linux streams, including RHEL 6 ELS, RHEL 7 ELS, the RHEL 8 update streams, and the RHEL 9.2.0.z, 9.4.z, and 9.6.z and RHEL 10.0.z update streams, are not affected because the vulnerable code is not present in those kernels. For the affected streams the fix is currently deferred and is planned to be delivered in a future scheduled kernel update rather than an immediate out-of-cycle erratum. Until a fixed kernel is available, the residual risk is limited to local denial of service: a user with access to the graphics subsystem on an affected system can crash the machine, but cannot gain elevated privileges or access data.