CVE-2026-74449

7.8

AMD · Linux

A divide-by-zero vulnerability exists in the Linux kernel's AMD display driver when handling zero-area viewports, potentially leading to system instability.

Executive summary

A high-severity divide-by-zero vulnerability in the Linux kernel AMD display driver could allow a local authenticated attacker to trigger a system crash.

Vulnerability

The vulnerability exists in the calculate_mcache_setting function within the DRM AMD display driver. It is triggered when a plane reaches the function with a zero-area viewport, causing an early exit with invalid parameters that lead to a divide-by-zero error.

Business impact

Successful exploitation of this vulnerability results in a denial of service, as the divide-by-zero condition will cause the system to crash. While the CVSS score of 7.8 indicates high severity, it requires local access, which limits the attack surface to authenticated users or those with local execution capabilities.

Remediation

Immediate Action: Apply the latest kernel security updates provided by your Linux distribution, ensuring the kernel is at least version 7.1.8.

Proactive Monitoring: Monitor system logs for kernel oops or crash reports originating from the drm/amd/display module.

Compensating Controls: Restrict local user access and ensure that hardware drivers are kept at the latest stable version provided by the kernel maintainers.

Exploitation status

Public Exploit Available: No

Analyst recommendation

System administrators should prioritize patching the Linux kernel to version 7.1.8 to prevent potential denial of service attacks. While the local requirement reduces the immediate threat, ensuring kernel stability is critical for maintaining server and workstation uptime.

More AMD CVEs