{"id":"CVE-2026-43337","summary":"drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()\n\ndcn401_init_hw() assumes that update_bw_bounding_box() is valid when\nentering the update path. However, the existing condition:\n\n  ((!fams2_enable && update_bw_bounding_box) || freq_changed)\n\ndoes not guarantee this, as the freq_changed branch can evaluate to true\nindependently of the callback pointer.\n\nThis can result in calling update_bw_bounding_box() when it is NULL.\n\nFix this by separating the update condition from the pointer checks and\nensuring the callback, dc-\u003eclk_mgr, and bw_params are validated before\nuse.\n\nFixes the below:\n../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc-\u003eres_pool-\u003efuncs-\u003eupdate_bw_bounding_box' could be null (see line 362)\n\n(cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)","modified":"2026-10-28T02:31:02.094095089Z","published":"2026-05-08T13:31:22.967Z","related":["SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:3130-1","SUSE-SU-2026:3166-1","openSUSE-SU-2026:21388-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43337.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/10c13c111d0d7f8e101c742feff264fc98e3f9f7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2d4a6f0702c5211e0be8b688c5fc24f082ec74d6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e927b36ae18b66b49219eaa9f46edc7b4fdbb25e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fcc51c81cb472eb460310c477460356dc4845ff7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43337.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43337"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4"},{"fixed":"fcc51c81cb472eb460310c477460356dc4845ff7"},{"fixed":"10c13c111d0d7f8e101c742feff264fc98e3f9f7"},{"fixed":"2d4a6f0702c5211e0be8b688c5fc24f082ec74d6"},{"fixed":"e927b36ae18b66b49219eaa9f46edc7b4fdbb25e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.11.3"},{"fixed":"6.12"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e13689793b9c0e7b5749954e77f5f85e68fe7138"}]}],"versions":["v6.11.11","v6.11.10","v6.11.9","v6.11.8","v6.11.7","v6.11.6","v6.11.5","v6.11.4","v6.11.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43337.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.114"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43337.json"}}],"schema_version":"1.9.2"}