CVE-2026-53285 is a Linux kernel vulnerability in the drm/amd/display subsystem. The function dcn32_validate_bandwidth() disables local softirqs by taking fpregs_lock() in non-RT x86 systems. Within this preemption-disabled region, a call to kvzalloc() for allocating approximately 335 KiB triggers a BUG_ON(in_interrupt()) due to invoking vmalloc in an interrupt context, leading to a kernel crash. The fix involves wrapping the dc_state_create_phantom_plane() allocation call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro, allowing preemption during memory allocation and preventing the crash. This patch was cherry-picked and included in linux-hwe-edge kernel versions 7.0.0-28.28 and later.

The vulnerability causes a kernel crash (denial of service) due to improper memory allocation in a preemption-disabled context within the AMD display driver. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity) with an attack vector limited to local access, requiring low privileges and no user interaction. No known exploits in the wild have been reported.

A patch is available and should be applied by updating to linux-hwe-edge kernel versions 7.0.0-28.28 or later as provided by the vendor. After applying the update, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's official update instructions to ensure the vulnerability is remediated.