VulnerabilityPublished 18 Oct 2026

CVE-2026-98786: Linux kernel · drm/amd/display: guard dc_sink dereferences in MST mode validation

Affects Linux kernelSource CVE Database V5

Not known to be exploited : upgrade to daa0437fe5e451856aaf8fda602a9fc2105bbd54 or 217f64f348c90cba62164e7ff38e0ccf78a5ca09 when convenient.

Data as of 26 Oct 2026, 11:42 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in daa0437fe5e451856aaf8fda602a9fc2105bbd54, 217f64f348c90cba62164e7ff38e0ccf78a5ca09

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to daa0437fe5e451856aaf8fda602a9fc2105bbd54 or 217f64f348c90cba62164e7ff38e0ccf78a5ca09.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f04d275d94e164d24516c32437c988a323018f63, < daa0437fe5e451856aaf8fda602a9fc2105bbd54	Fixed in daa0437fe5e451856aaf8fda602a9fc2105bbd54
LinuxLinux	Affected ≥ f04d275d94e164d24516c32437c988a323018f63, < 217f64f348c90cba62164e7ff38e0ccf78a5ca09	Fixed in 217f64f348c90cba62164e7ff38e0ccf78a5ca09
LinuxLinux	Affected =6.0	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel commits daa0437fe5e451856aaf8fda602a9fc2105bbd54 and 217f64f348c90cba62164e7ff38e0ccf78a5ca09. Users and administrators should update to a Linux kernel version including these commits or later to remediate this issue.

Description

A use-after-free or null pointer dereference vulnerability was identified in the Linux kernel's AMD display driver related to MST mode validation. The flaw involves dereferencing the dc_sink pointer without a NULL check during certain mode validation and bandwidth calculation functions, which can occur due to asynchronous teardown of the sink on MST unplug. This can lead to invalid memory access. The issue has been fixed by adding checks to fail the port-support validation and skip the FRL conversion path when the sink is absent.

Impact

The vulnerability can cause invalid memory dereferences leading to potential system crashes or instability when MST mode validation occurs concurrently with MST unplug events. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

Summary

CVE-2026-98786 is a vulnerability in the Linux kernel AMD display driver affecting MST (Multi-Stream Transport) mode validation. The functions dm_dp_mst_is_port_support_mode() and get_conv_frl_bw() dereference the dc_sink pointer without verifying it is non-NULL, despite dc_sink being asynchronously cleared on MST unplug events. This race condition can cause invalid memory access or crashes. The fix involves adding NULL checks to these functions to prevent dereferencing a cleared dc_sink, thereby avoiding use-after-free or null pointer dereference issues. The fix was applied in commits daa0437fe5e451856aaf8fda602a9fc2105bbd54 and 217f64f348c90cba62164e7ff38e0ccf78a5ca09.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 09:57 UTC

Technical details

References

Community reviews

Related threats