{"id":"CVE-2026-98654","summary":"drm/amd/display: Atomize IRQ register read/modify/write ops","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.\n\nTo enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the\nGLOBAL_SYNC_STATUS register.\n\nTo ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR\nbit in the same GLOBAL_SYNC_STATUS register.\n\nThe bit sets are done through read/modify/write operations, which are\nnot atomic. Thus, the following race is possible:\n\n    Thread A:                       IRQ handler:\n                                    *HW IRQ fires*\n    # IRQ disable\n    val = read(GLOBAL_SYNC_STATUS)\n    unset(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # ACK reads VUPDATE_NO_LOCK_EN unset\n                                    val1 = read(GLOBAL_SYNC_STATUS)\n                                    set(val1, VUPDATE_NO_LOCK_CLEAR)\n    # IRQ enable\n    val = read(GLOBAL_SYNC_STATUS)\n    set(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # BAD! clears VUPDATE_NO_LOCK_EN\n                                    write(val1, GLOBAL_SYNC_STATUS)\n\nRegarding the tagged Fixes: change, it appears the change made this race\nmore likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source\nfor vblank handling, a single race on high refresh panels can lead to a\ntime out.\n\n[How]\n\nThe GLOBAL_SYNC_STATUS register is only one example, other IRQ control\nregisters also share the same scheme. On top of GLOBAL_SYNC_STATUS,\nlet's clean up those as well.\n\nTo keep things simple, Let's atomize the IRQ rmw ops via a single\ndriver-wide spinlock. Due to the small scope of this lock, it is\nunlikely to cause noticeable overhead on top of all the existing locking\nwithin the IRQ set/handle paths.\n\nSince DM is responsible for locking, wrap dc_interrupt_set/ack with the\nspinlock in the new amdgpu_dm_irq_set/ack functions. Migrate/drop all\nreferences in DM to dc_interrupt_set/ack to use amdgpu_dm_irq_set/ack\ninstead.\n\n(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)","modified":"2026-10-19T02:47:02.643815507Z","published":"2026-10-18T15:20:25.640Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98654.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/63e19ef3ddab806c472748c825f4dc88dcd994e8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98654.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98654"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"c87e6635d2db02c88ae8d09529362da672d34770"},{"fixed":"63e19ef3ddab806c472748c825f4dc88dcd994e8"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98654.json"}}],"schema_version":"1.9.0"}