Security readout for executives and security teams
Plain-English summary
A flaw in the Linux AMD display driver can dereference an invalid pointer while reading monitor identification data. The documented failure crashes kernel code during connector handling, creating serious availability risk on affected systems. The supplied CVSS also rates potential confidentiality and integrity impact highly, although the public description demonstrates a crash rather than those outcomes.
Executive priority
Treat as a high-priority endpoint stability issue where affected AMD graphics hardware and local multi-user access coincide. Patch through normal kernel channels promptly, but do not infer internet-wide exposure: the evidence supports a configuration-dependent local kernel fault, with no cited active exploitation.
Technical view
When an AMD display link lacks aux_mode, EDID handling can pass an invalid adapter into i2c_transfer. The reported path involves DCN2.1 hardware, an HDMI connector, and forced connector-state testing, producing a kernel NULL-pointer dereference. The fix uses the I2C adapter when AUX mode is unavailable.
Likely exposure
Prioritize Linux systems using AMD DCN2.1 display hardware with HDMI connectors. The bundle identifies affected Linux 6.7-era ranges bounded by 6.7.7 and 6.8, but its flattened version data is ambiguous. Confirm exposure using distribution advisories and whether the cited stable fix is present.
Exploitation context
The documented trigger is a local IGT connector test, and the supplied CVSS requires local access with low privileges and no user interaction. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. Practical reachability outside the reported hardware and connector configuration is not established.
Researcher notes
The observed call path reaches i2c_transfer through DRM EDID probing and amdgpu connector validation. Reproduction used igt@kms_force_connector_basic on DCN2.1 with HDMI. Public evidence establishes a NULL dereference and corrective adapter selection; it does not demonstrate code execution, data disclosure, or active exploitation. Exact downstream backport coverage requires vendor confirmation.
Mitigation direction
- Upgrade to a distribution-supported kernel containing the applicable cited stable fix.
- Check the Linux vendor or distribution advisory for exact fixed package versions.
- Prioritize shared workstations and other systems allowing untrusted local users.
- If updating is delayed, restrict unnecessary local access and monitor affected systems for kernel crashes.
Validation and detection
- Inventory kernel versions and systems using AMD DCN2.1 graphics with HDMI connectors.
- Confirm the installed kernel includes the applicable cited stable commit or distribution backport.
- Review kernel logs for NULL dereferences involving i2c_transfer, EDID, DRM, or amdgpu.
- Run connector regression testing only in a controlled environment because the vulnerable path can crash kernel code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26728 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2d392f7268a1a9bfbd98c831f0f4c964e59aa145CVE reference, Linux
- https://git.kernel.org/stable/c/9671761792156f2339627918bafcd713a8a6f777CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.