GHSA-PQHQ-6V8M-MFRC
Vulnerability from github – Published: 2026-08-28 09:31 – Updated: 2026-08-28 09:31In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: use proper context for logging
The same as the rest of the code, get_ss_info_from_atombios() uses calc_pll_cs->ctx->logger for logging. But calc_pll_cs->ctx is initialized only later in calc_pll_max_vco_construct(). Therefore, any output using DC_LOG_SYNC() leads to a NULL pointer deference in get_ss_info_from_atombios().
According to Sashiko, the very same problem exists in dce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.
To avoid accessing the NULL context, use clk_src->base.ctx->logger everywhere. That context in base is initialized earlier in dce110_clk_src_construct() and dce112_clk_src_construct(). Before get_ss_info_from_atombios() or Sashiko's get_pix_clk_dividers functions above are actually called. This is done by redefining DC_LOGGER to CTX->logger.
Before: dce110_clk_src_construct() did: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses calc_pll_cs->ctx # BOOM -> calc_pll_max_vco_construct() <- sets calc_pll_cs->ctx
After: dce110_clk_src_construct() does: -> sets clk_src->base.ctx = ctx; -> ss_info_from_atombios_create() -> get_ss_info_from_atombios() <- uses clk_src->base.ctx
(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)
{
"affected": [],
"aliases": [
"CVE-2026-80704"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-28T08:16:55Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: use proper context for logging\n\nThe same as the rest of the code, get_ss_info_from_atombios() uses\ncalc_pll_cs-\u003ectx-\u003elogger for logging. But calc_pll_cs-\u003ectx is\ninitialized only later in calc_pll_max_vco_construct(). Therefore, any\noutput using DC_LOG_SYNC() leads to a NULL pointer deference in\nget_ss_info_from_atombios().\n\nAccording to Sashiko, the very same problem exists in\ndce112_get_pix_clk_dividers() and dcn3_get_pix_clk_dividers() too.\n\nTo avoid accessing the NULL context, use clk_src-\u003ebase.ctx-\u003elogger\neverywhere. That context in base is initialized earlier in\ndce110_clk_src_construct() and dce112_clk_src_construct(). Before\nget_ss_info_from_atombios() or Sashiko\u0027s get_pix_clk_dividers functions\nabove are actually called. This is done by redefining DC_LOGGER to\nCTX-\u003elogger.\n\nBefore:\ndce110_clk_src_construct() did:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses calc_pll_cs-\u003ectx # BOOM\n -\u003e calc_pll_max_vco_construct() \u003c- sets calc_pll_cs-\u003ectx\n\nAfter:\ndce110_clk_src_construct() does:\n -\u003e sets clk_src-\u003ebase.ctx = ctx;\n -\u003e ss_info_from_atombios_create()\n -\u003e get_ss_info_from_atombios() \u003c- uses clk_src-\u003ebase.ctx\n\n(cherry picked from commit 6f16fcbb0c46a87e3d9685407e906573d60104b0)",
"id": "GHSA-pqhq-6v8m-mfrc",
"modified": "2026-08-28T09:31:50Z",
"published": "2026-08-28T09:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80704"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/02647d98340738f918690ed227fdcf154db1b84a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/114b42507b6a23d9d24e24e4ef165233332c64d4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a94e62b7c7018fcfe0251e53fa96af30f12d923a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f556bc844cc4423e5ad41ae41a4c24f1cf75b978"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.