CVE-2026-89819

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: validate plane degamma LUT size for private color prop

Unlike the CRTC degamma path, which is guarded by

amdgpu_dm_verify_lut_sizes(), the per-plane degamma LUT size was never

validated before use. __set_dm_plane_degamma() passed the user-supplied

size straight into __is_lut_linear() and, for a non-linear LUT, into

__set_input_tf() -> __drm_lut_to_dc_gamma(), the latter always iterating

MAX_COLOR_LUT_ENTRIES entries regardless of the actual LUT size.

A malformed AMD_PLANE_DEGAMMA_LUT blob (e.g. a single entry) could thus

trigger a divide-by-zero in __is_lut_linear() or an out-of-bounds read in

__drm_lut_to_dc_gamma(). Reject any plane degamma LUT whose size does not

match MAX_COLOR_LUT_ENTRIES, mirroring the invariant the code already

asserts a few lines below (and which the CRTC path enforces).

The AMD_PLANE_DEGAMMA_LUT property is only exposed on builds with

AMD_PRIVATE_COLOR defined.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References