---
id: CVE-2026-53285
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  drm/amd/display: Wrap DCN32 phantom-plane allocation in
  DC_RUN_WITH_PREEMPTION_ENABLED


  [Why]

  dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with

  DC_FP_S…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  drm/amd/display: Wrap DCN32 phantom-plane allocation in
  DC_RUN_WITH_PREEMPTION_ENABLED


  [Why]

  dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with

  DC_FP_S…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-617
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.0, < 7.0.10'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.10
published: '2026-06-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:36.987'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53285'
references:
  - url: 'https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a8c1480bb066cf0f6e79129b7292e1c99ff68b9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00107
epssPercentile: 0.01099
ingestedAt: '2026-10-15T11:00:41.699Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED

[Why]
dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with
DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),
which disables local softirqs.

The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to
allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,
which calls BUG_ON(in_interrupt()) because it's invoked within the
FPU-enabled (softirq disabled) region, leading to a kernel crash.

[How]
Wrap the dc_state_create_phantom_plane() call with the
DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during
this memory allocation.

(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)

## Affected

- `linux_kernel >= 6.0, < 7.0.10`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.10`