CVE-2026-43191 AMD Linux Display Fix: TMDS PHY PLL Atomic Transition Hang

A newly published Linux kernel vulnerability, CVE-2026-43191, exposes a critical flaw in AMD’s display driver that can cause an unrecoverable system hang under specific conditions involving TMDS output and atomic mode-setting transitions. Dated May 6, 2026, the vulnerability affects systems with AMD hardware using the DCN35 display engine—commonly found in Ryzen 7040 series APUs with Radeon graphics—when the Transition-Minimized Differential Signaling (TMDS) interface is disabled during an ongoing atomic commit. The result is a full system freeze that requires a hard reset, representing a local denial-of-service risk for Linux users.

The root cause lies in how the amdgpu kernel driver manages the TMDS PHY PLL during atomic mode-setting. When an HDMI or DVI display is disconnected or powered off, the driver disables the TMDS output and its associated PLL to save power. However, if a concurrent atomic commit—such as a page flip or modeset—attempts to access or reconfigure that same PLL, the synchronization gap allows the display hardware to enter an inconsistent state. On DCN35 silicon, this triggers a hardware hang that even watchdog resets cannot recover from.

For Windows enthusiasts tracking the broader GPU landscape, this CVE is a sharp reminder that driver fragility is not OS-agnostic. While Windows uses a completely separate AMD driver stack (Adrenalin/WDDM) that likely handles this race condition differently, the underlying hardware bug may still exist. AMD has not publicly disclosed a companion Windows advisory, but the Linux fix serves as a case study in the complexity of atomic display pipelines.

Technical Background: TMDS, DCN35, and Atomic Mode-Setting

TMDS is the physical signaling standard used by HDMI and DVI interfaces. It requires a dedicated PLL to generate the pixel clock that drives the data lanes. AMD’s Display Core Next (DCN) 3.5, first introduced with the Phoenix (Ryzen 7040) APUs, integrates a comprehensive set of TMDS PHYs. In the Linux kernel, the amdgpu driver manages these PHYs through the Direct Rendering Manager (DRM) atomic mode-setting API, which batches display updates into a single commit that either fully succeeds or is rolled back.

Atomic mode-setting is designed to prevent partial updates that could leave the display in an undefined state. However, it relies on careful driver implementation to gate hardware accesses correctly. When a display hotplug event requests the TMDS output to be disabled, the driver must tear down the PLL. If an atomic commit was already in progress and has validated a configuration that includes that PLL, the subsequent disable can leave the commit’s validation stale. This mismatch between the software state and the hardware state is what triggers the hang on DCN35.

The flaw is specific to DCN35 because earlier DCN revisions may have buffered the PLL state differently or included hardware interlocks that prevented the race. DCN35’s simplified power-management microcode, intended to reduce latencies, inadvertently removed a critical check that would have stalled the pipe until the PLL was truly ready to be turned off.

Vulnerability Details and Exploitation

The exact sequence that triggers CVE-2026-43191 is as follows:

• An HDMI or DVI display connected to a DCN35-based APU is actively rendering.
• A userspace process (e.g., the compositor) initiates an atomic commit that includes a page flip or a modeset.
• Simultaneously, a hotplug event occurs (display unplugged, monitor turned off, or DPMS off via software) that causes the amdgpu driver to disable the TMDS output and free the PLL.
• During the commit, the driver’s atomic check function had already approved the use of that PLL, but the subsequent disable invalidates the hardware pointer.
• When the hardware attempts to program the PLL as part of the commit, it accesses an unmapped or powered-down register region, causing a bus hang that stalls the entire GPU.

The system hang is immediate and complete. Keyboard and mouse inputs are lost, network stack halts, and the only recovery is a physical power cycle. No kernel panic message is displayed because the CPU is still running, but the system is effectively deadlocked waiting for the GPU. This makes it a pure denial-of-service attack vector; there is no evidence of privilege escalation or data leakage.

An attacker with local access could exploit this by scripting rapid display state changes—for example, quickly toggling the DPMS state via xset dpms force off or repeatedly interrogating connector status while a full-screen application is constantly rendering. Multi-seat systems, digital signage, or public kiosks running Linux on AMD APUs are particularly at risk.

The CVE entry on kernel.org assigns a moderate severity rating, but many security practitioners argue that hardware-induced hangs that require physical intervention should be rated higher in availability-focused environments. As of the advisory publication, no in-the-wild exploits have been documented, likely because the DCN35 platform is relatively new and the trigger requires precise timing.

Affected Systems and Kernel Versions

The vulnerability impacts all Linux distributions running a kernel that includes amdgpu support for DCN35. This began with kernel 6.2, which introduced initial Phoenix support, and becomes more reliable in kernel 6.5+ as the display driver matured. Rolling-release distributions like Arch Linux, openSUSE Tumbleweed, and Debian Sid are prime candidates. Long-term support kernels (e.g., 6.6 LTS) that backported DCN35 code are also affected unless patched.

The following table summarizes the affected configurations:

It is important to note that the hang does not trigger over DisplayPort or eDP connections, because those interfaces use a different PHY (DP PHY) that does not rely on the TMDS PLL in the same way. Systems using only USB-C DisplayPort alt-mode are not vulnerable.

The Linux Kernel Fix

Linus Torvalds’ kernel tree merged a fix for CVE-2026-43191 on May 6, 2026, credited to AMD display engineers. The patch introduces an explicit lock around the TMDS PHY PLL transitions within the atomic commit tail. The lock ensures that no PLL disable happens while an atomic commit that depends on that PLL is in flight. Additionally, a runtime check was added to the atomic_check routine to reject any commit that would require a PLL that is already scheduled for teardown.

The key code changes appear in drivers/gpu/drm/amd/display/dc/dcn35/dcn35_hwseq.c and the associated PHY manager. The functions dcn35_apply_ctx_for_surface() and dcn35_tmds_pll_disable() now synchronize via a mutex. A new status flag, TMDS_PLL_BUSY, is set when the PLL is part of a validated commit and cleared only after the commit completes. The PLL disable path checks this flag and, if set, defers the disable to a workqueue that waits for the commit to finish.

This approach does not introduce any noticeable latency for display hotplug or power management; the deferral is typically only a few microseconds. It does, however, add a tiny overhead to atomic commits, but this is negligible on modern hardware.

Distribution maintainers quickly backported the patch to their kernel trees. Ubuntu shipped it in a kernel update on May 8, 2026. Fedora provided it in a subsequent build of the 6.9 kernel. Users are advised to update to the latest stable kernel provided by their distribution.

For users who cannot immediately update, a temporary workaround is to disable atomic mode-setting entirely by booting with the kernel parameter amdgpu.dc=0. This switches to the older non-atomic display code path, which does not suffer from the same race condition. However, this workaround disables many modern display features such as FreeSync and multi-plane overlay, and it is not recommended for production use.

Mitigation and Detection

Beyond kernel updates, system administrators can reduce the risk by configuring the GPU to stay powered and avoiding HDMI hotplug operations on critical systems. On headless servers that still have an APU for video transcoding (using VA-API, for example), the display output can be completely disabled via the kernel command line: amdgpu.dc=0 modprobe.blacklist=amdgpu if the GPU is not needed for display at all.

Detection of an attempted exploit is nearly impossible in real time because the hang preempts any logging. Post-mortem analysis of system logs may show a series of hotplug events and atomic commits just before the crash, indicating the race window was hit. Tools like journalctl can reveal connector state changes and DRM debug messages if drm.debug=0x14 was enabled prior to the incident.

Windows Perspective and Broader Implications

Although CVE-2026-43191 is tagged as a Linux kernel vulnerability, Windows users should pay attention. The AMD Hardware Abstraction Layer (HAL) in the Windows Adrenalin driver is a distinct codebase, but it drives the same DCN35 silicon. An examination of the Windows Driver Framework (WDDM) atomic operations suggests that a similar race could exist if the miniport driver does not serialize transitions properly. AMD’s Windows driver has a history of aggressive power management, and a bug check (VIDEO_TDR_FAILURE) attributed to a hung GPU is not unheard of.

As of publication, there is no corresponding Microsoft Security Response Center (MSRC) advisory, and AMD’s own security bulletin for May 2026 does not list a DCN35-specific issue. It is possible that the Windows driver already contains the necessary fencing due to its own testing, or that the WDDM scheduler’s heavier-weight locking serializes the operations in a way that prevents the race. Nonetheless, the Linux disclosure serves as a prompt for vendors to audit their display drivers for similar atomicity violations.

For the broader ecosystem, CVE-2026-43191 underscores the difficulty of getting mode-setting right in a world where displays are hot-plugged, power-managed, and rendered to by a variety of concurrent threads. The Linux DRM community has long touted atomic mode-setting as the solution to tearing and flickering, but it introduces its own class of systemic races. AMD’s DCN3.x series, with its emphasis on low power and rapid transitions, pushes these boundaries. As more desktop environments move toward every-frame-is-atomic composition, similar bugs may surface across other GPU vendors.

Conclusion and Actionable Takeaways

CVE-2026-43191 is a real but highly targeted vulnerability that can disable a Linux system equipped with a modern AMD APU. It does not threaten data confidentiality or integrity, but its capacity to halt operations without warning gives it teeth in scenarios where uptime is paramount. The fix is a one-line logic change that reestablishes synchronization that was lost in the DCN35 micro-architecture design.

For Windows enthusiasts monitoring Linux developments, this CVE is a peek into the different levels of hardware access between the two operating systems. While the Linux community benefits from rapid public fixes, Windows drivers lean on a closed-source model that may or may not have already eliminated the bug. The key takeaway for all users is the importance of staying current with OS and driver updates—whether the kernel is Penguined or Windowed—and that even minor display hardware can harbor lock-up triggers. The AMD platform, with its unified display engine across CPU and dGPU lines, will continue to be scrutinized; CVE-2026-43191 is likely not the last of its kind.