# CVE-2026-68235: drm/amd/display: dce100: skip non-DP stream encoders for DP MST

> A null pointer dereference in the AMD display driver causes a kernel crash when connecting a second monitor via DisplayPort MST on specific hardware.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 10 Aug 2026
- **Updated:** 18 Aug 2026
- **Also known as:** DEBIAN-CVE-2026-68235, GHSA-23xc-5vxv-wj6v, UBUNTU-CVE-2026-68235

## What is CVE-2026-68235?

CVE-2026-68235 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: dce100: skip non-DP stream encoders for DP MST

On DCE8-class ASICs (e.g. Bonaire), the resource pool contains digital
DIG stream encoders plus one analog DAC encoder. When assigning a stream
encoder for a second DisplayPort MST stream, if the preferred digital
encoder is already acquired, dce100_find_first_free_match_stream_enc_for_link()
falls back to the first free pool entry. That entry may be the analog
encoder, whose funcs table lacks DP hooks such as dp_set_stream_attribute.
The subsequent atomic commit then dereferences NULL function pointers in
link_set_dpms_on() and crashes.

Skip encoders without dp_set_stream_attribute when the stream uses a DP
signal (including MST). Use dc_is_dp_signal(stream->signal) for the MST
fallback path instead of checking only the link connector signal.

Tested on:
- GPU: AMD Radeon R7 260X (Bonaire / DCE8)
- Board: Supermicro C9X299-PG300
- Setup: DP MST daisy chain, hotplug second monitor or have it connected on boot
- Kernel: 7.1.3 (issue observed since 6.19)
- Result: kernel oops without patch; dual monitors stable with patch

(cherry picked from commit 28ec64943e3ee4d9b8d30cea61e380f1429953a8)

## Which versions are affected by CVE-2026-68235?


## How do I fix CVE-2026-68235?

Apply the vendor's patch.

## Is CVE-2026-68235 being exploited?

There is no known exploitation of CVE-2026-68235 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-68235 and fix it if it is affected.

What it is: CVE-2026-68235 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2026-68235 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-68235/ (Markdown: https://insights.sbomify.com/CVE-2026-68235/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-68235
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-68235
- OSV: https://osv.dev/vulnerability/CVE-2026-68235

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-68235/
Summaries are generated and may contain mistakes; the official description above is the record.