CVE-2026-74732: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-74732 is a NULL pointer dereference vulnerability in the Linux kernel's AMD display driver (drm/amd/display) within the dce110_set_avmute function. Some older DCE (Display Core Engine) timing generators do not implement the is_tg_enabled operation in their ops table; calling it unconditionally when waiting for AV mute frames triggers a kernel crash on Southern Islands discrete GPUs when turning off a display over HDMI. The vulnerability was published on August 22, 2026, and affects Linux kernel versions before 6.12.104, 6.18.45, and 7.1.9. No CVSS score has been formally assigned by NVD at this time; Feedly estimates the severity as Medium (GitHub Advisory, NVD).

The root cause is a missing null-pointer check (CWE-476: NULL Pointer Dereference) in drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c. When dce110_set_avmute is called during HDMI display power-off on Southern Islands dGPUs, it unconditionally invokes tg->funcs->is_tg_enabled() without first verifying that the timing generator (tg) pointer and its function pointer table (funcs) are non-NULL. Older DCE timing generators omit this callback from their ops table, resulting in a NULL function pointer dereference and a kernel panic. The fix, cherry-picked from upstream commit 2686a0c0aaa07bec2e24131835cf27b5fd4935a5, adds an existence check for tg and the required ops before the frame-wait loop is entered (GitHub Advisory, NVD).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and complete loss of availability for the affected host. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise, and the crash is not exploitable for code execution under normal conditions. The vulnerability is hardware-specific, affecting only systems with AMD Southern Islands discrete GPUs using older DCE timing generators connected via HDMI (NVD, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-74732. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Triggering the bug requires local access to a system with an affected AMD Southern Islands dGPU and the ability to initiate an HDMI display power-off sequence, significantly limiting the attack surface (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.12.104 or later (for the 6.12.x stable branch), 6.18.45 or later (for the 6.18.x branch), 7.1.9 or later (for the 7.1.x branch), or any release at or after 7.2. The fix is contained in upstream stable commits 853c2d31408b, d089f32d34f8, 5edbb409b0bc, and 3141e3d61469. As a temporary workaround on affected hardware, avoiding HDMI display power-off cycles (e.g., keeping the display active or using a different output interface) can prevent the crash until the kernel is updated (GitHub Advisory, NVD).