CVE-2026-31460

Root

Cause

The vulnerability resides in the drm/amd/display driver's backlight (BL) setup routine. When handling LVDS connectors, the code attempts to access extended backlight capabilities (ext_caps) without first verifying that the pointer is valid. LVDS connectors do not provide these extended caps, so the pointer can be NULL, leading to a null-pointer dereference [1].

Exploitation

An attacker would need to have local access to a system with an AMD GPU that uses the affected display driver and an LVDS display panel. No special privileges beyond the ability to trigger display mode changes are required. The bug is triggered during normal display initialization or when the system resumes from suspend, making it reachable without explicit malicious actions [1].

Impact

A successful null-pointer dereference causes a kernel panic, resulting in a denial of service (system crash). The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and the availability impact. No data confidentiality or integrity is compromised [1].

Mitigation

The fix was introduced in Linux kernel commit 2026 via commit 3f797396d7f4 and backported to stable kernels. Users should update to a kernel version containing this commit or the relevant backport. No workaround is available other than applying the patch [1].