The Linux kernel vulnerability CVE-2026-53135 involves the drm/amd/display component where dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without verifying if these pointers are NULL. This can happen if a connector is connected but not bound to any CRTC, such as after a hot-plug event before the next atomic commit, leading to a kernel crash. Additionally, the function ignores the user-provided size argument and always copies 36 bytes from user space, causing a buffer over-read if the provided size is less than 36 bytes. The fix involves returning an error (-ENODEV) if the pointers are NULL and clamping the write size to the minimum of the user-provided size and the expected data size.

This vulnerability can cause a denial of service by crashing the kernel when a user writes to the sdp_message debugfs node under certain conditions. There is no impact on confidentiality or integrity reported. No known exploits are in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding NULL pointer checks and properly handling the user buffer size. Until a patch is applied, avoid writing to the sdp_message debugfs node to prevent triggering the kernel crash.