CVE-2026-68236: drm/amd/display: set new_stream to NULL after release

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: set new_stream to NULL after release

In dm_update_crtc_state(), the skip_modeset path releases new_stream
via dc_stream_release() but does not set the pointer to NULL.

If a later error (e.g., color management failure) triggers the fail
label, the error path calls dc_stream_release() again on the same
dangling pointer, causing a double release and potential use-after-free.

Fix this by setting new_stream to NULL after the initial release.

(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)

The Linux kernel CVE team has assigned CVE-2026-68236 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.15 with commit 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f and fixed in 6.6.148 with commit ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76
	Issue introduced in 4.15 with commit 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f and fixed in 6.12.101 with commit 5182e442e61397d446c36995b8f5676942d35b82
	Issue introduced in 4.15 with commit 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f and fixed in 6.18.42 with commit 679f23f0a3606afcef1ffabd72222f00a54ad9e3
	Issue introduced in 4.15 with commit 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f and fixed in 7.1.6 with commit 0676fecbb5242aa22c057e78326d6d6041db034c
	Issue introduced in 4.15 with commit 9b690ef3c70422cdcd0cf912db33f2c92ef4a53f and fixed in 7.2-rc4 with commit 9fa26b9eed6195bf840f39ac183b9a6237548755

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68236
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ba8bf1dcbb44773e7a0fd13b42925c644e0d5e76
	https://git.kernel.org/stable/c/5182e442e61397d446c36995b8f5676942d35b82
	https://git.kernel.org/stable/c/679f23f0a3606afcef1ffabd72222f00a54ad9e3
	https://git.kernel.org/stable/c/0676fecbb5242aa22c057e78326d6d6041db034c
	https://git.kernel.org/stable/c/9fa26b9eed6195bf840f39ac183b9a6237548755