CVE-2026-31488

OVERVIEW CVE-2026-31488 is a use-after-free vulnerability in the Linux kernel's AMD display driver (amdgpu). The issue occurs in the DSC (Display Stream Compression) validation logic when multiple display configuration changes happen simultaneously. Specifically, the driver incorrectly resets the mode_changed flag during DSC prevalidation when handling scenarios involving MST (Multi-Stream Transport) configuration changes combined with unrelated mode adjustments on other displays. This results in memory leaks and use-after-free conditions affecting the amdgpu display subsystem in the Linux kernel. SEVERITY The vulnerability stems from inadequate state management during atomic display commits, allowing old display streams to remain unreleased while new streams fail to acquire proper references. The attack vector requires local access to the display subsystem through legitimate KMS (Kernel Mode Setting) operations, making exploitation require elevated privileges or direct user interaction with display configuration. While the CVSS score is not assigned, the presence of a use-after-free condition with KASAN detection capability indicates memory safety concerns. The FAUCET Risk Score of 20.0/100 and EPSS score of 0.00018 suggest relatively low overall risk, though memory corruption vulnerabilities warrant attention. EXPLOITATION STATUS This vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation. No public exploit code is documented. Community attention has been minimal, as indicated by the inactive Hot List status. The vulnerability was identified through kernel development processes and resolved via upstream commit cc7c7121ae082b7b82891baa7280f1ff2608f22b, which has been cherry-picked into stable branches. Organizations should apply available kernel patches when released.