{"api_version":"1","generated_at":"2026-05-13T03:11:57+00:00","cve":"CVE-2026-43191","urls":{"html":"https://cve.report/CVE-2026-43191","api":"https://cve.report/api/cve/CVE-2026-43191.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-43191","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-43191"},"summary":{"title":"drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-05-06 12:16:37","updated_at":"2026-05-11 20:51:38"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da","name":"https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51","name":"https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43191","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43191","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ec129fa356bea5411cb16833cc5dab32689ea389 d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ec129fa356bea5411cb16833cc5dab32689ea389 75372d75a4e23783583998ed99d5009d555850da git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.7","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.7 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19.6 6.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2026","cve_id":"43191","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"43191","cve":"CVE-2026-43191","epss":"0.000140000","percentile":"0.029270000","score_date":"2026-05-12","updated_at":"2026-05-13 00:11:53"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c","drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h","drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51","status":"affected","version":"ec129fa356bea5411cb16833cc5dab32689ea389","versionType":"git"},{"lessThan":"75372d75a4e23783583998ed99d5009d555850da","status":"affected","version":"ec129fa356bea5411cb16833cc5dab32689ea389","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c","drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h","drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.7"},{"lessThan":"6.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.6","versionStartIncluding":"6.7","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0","versionStartIncluding":"6.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly."}],"providerMetadata":{"dateUpdated":"2026-05-07T17:14:38.021Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"},{"url":"https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"}],"title":"drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-43191","datePublished":"2026-05-06T11:28:00.470Z","dateReserved":"2026-05-01T14:12:55.992Z","dateUpdated":"2026-05-07T17:14:38.021Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-06 12:16:37","lastModifiedDate":"2026-05-11 20:51:38","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.19.6","matchCriteriaId":"DF4885A9-B170-4EBE-9912-BA83564FBE78"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"43191","Ordinal":"1","Title":"drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON fo","CVE":"CVE-2026-43191","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"43191","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM's ability to ACK\ninvalidations when it thinks the HUBP is still on but it's not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there's no guarantee\nthat the thread isn't pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere's a functional difference in when the eDP output is disabled in\ndcn401 code so we don't want to utilize it directly.","Type":"Description","Title":"drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON fo"}]}}}