{"id":"CVE-2026-98654","title":"drm/amd/display: Atomize IRQ register read/modify/write ops","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c87e6635d2db02c88ae8d09529362da672d34770 < 63e19ef3ddab806c472748c825f4dc88dcd994e8","Linux 7.3-rc1"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:20:25.640Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98654","references":[{"url":"https://git.kernel.org/stable/c/63e19ef3ddab806c472748c825f4dc88dcd994e8"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.225Z","slug":"CVE-2026-98654","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.\n\nTo enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the\nGLOBAL_SYNC_STATUS register.\n\nTo ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR\nbit in the same GLOBAL_SYNC_STATUS register.\n\nThe bit sets are done through read/modify/write operations, which are\nnot atomic. Thus, the following race is possible:\n\n    Thread A:                       IRQ handler:\n                                    *HW IRQ fires*\n    # IRQ disable\n    val = read(GLOBAL_SYNC_STATUS)\n    unset(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # ACK reads VUPDATE_NO_LOCK_EN unset\n                                    val1 = read(GLOBAL_SYNC_STATUS)\n                                    set(val1, VUPDATE_NO_LOCK_CLEAR)\n    # IRQ enable\n    val = read(GLOBAL_SYNC_STATUS)\n    set(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # BAD! clears VUPDATE_NO_LOCK_EN\n                                    write(val1, GLOBAL_SYNC_STATUS)\n\nRegarding the tagged Fixes: change, it appears the change made this race\nmore likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source\nfor vblank handling, a single race on high refresh panels can lead to a\ntime out.\n\n[How]\n\nThe GLOBAL_SYNC_STATUS register is only one example, other IRQ control\nregisters also share the same scheme. On top of GLOBAL_SYNC_STATUS,\nlet's clean up those as well.\n\nTo keep things simple, Let's atomize the IRQ rmw ops via a single\ndriver-wide spinlock. Due to the small scope of this lock, it is\nunlikely to cause noticeable overhead on top of all the existing locking\nwithin the IRQ set/handle paths.\n\nSince DM is responsible for locking, wrap dc_interrupt_set/ack with the\nspinlock in the new amdgpu_dm_irq_set/ack functions. Migrate/drop all\nreferences in DM to dc_interrupt_set/ack to use amdgpu_dm_irq_set/ack\ninstead.\n\n(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)\n\n## Affected\n\n- `Linux >= c87e6635d2db02c88ae8d09529362da672d34770 < 63e19ef3ddab806c472748c825f4dc88dcd994e8`\n- `Linux 7.3-rc1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}