{"id":"CVE-2026-53285","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_S…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_S…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-617"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.0, < 7.0.10","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.10"],"published":"2026-06-26","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:36.987","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53285","references":[{"url":"https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00107,"epssPercentile":0.01099,"ingestedAt":"2026-10-15T11:00:41.699Z","slug":"CVE-2026-53285","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),\nwhich disables local softirqs.\n\nThe DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to\nallocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,\nwhich calls BUG_ON(in_interrupt()) because it's invoked within the\nFPU-enabled (softirq disabled) region, leading to a kernel crash.\n\n[How]\nWrap the dc_state_create_phantom_plane() call with the\nDC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during\nthis memory allocation.\n\n(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)\n\n## Affected\n\n- `linux_kernel >= 6.0, < 7.0.10`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.10`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222316,"id":"CVE-2026-53285","ts":1792065876367,"field":"cvss","old":null,"new":"5.5"},{"seq":222315,"id":"CVE-2026-53285","ts":1792065876367,"field":"severity","old":"none","new":"medium"}]}