CVE-2026-46245

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix dc_link NULL handling in HPD init

amdgpu_dm_hpd_init() may see connectors without a valid dc_link.

The code already checks dc_link for the polling decision, but later

unconditionally dereferences it when setting up HPD interrupts.

Assign dc_link early and skip connectors where it is NULL.

Fixes the below:

drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init()

error: we previously assumed 'dc_link' could be null (see line 931)

drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c

923 /*

924 * Analog connectors may be hot-plugged unlike other connector

925 * types that don't support HPD. Only poll analog connectors.

926 */

927 use_polling |=

928 amdgpu_dm_connector->dc_link &&

^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed

929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id);

930

931 dc_link = amdgpu_dm_connector->dc_link;

dc_link assigned here.

932

933 /*

934 * Get a base driver irq reference for hpd ints for the lifetime

935 * of dm. Note that only hpd interrupt types are registered with

936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on

937 * hpd_rx isn't available. DM currently controls hpd_rx

938 * explicitly with dc_interrupt_set()

939 */

--> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) {

^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here.

941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1;

942 /*

943 * TODO: There's a mismatch between mode_info.num_hpd

944 * and what bios reports as the # of connectors with hpd