{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "c87e6635d2db02c88ae8d09529362da672d34770"
            },
            {
              "fixed": "63e19ef3ddab806c472748c825f4dc88dcd994e8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98654.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Atomize IRQ register read/modify/write ops\n\n[Why]\n\nThe OTG_GLOBAL_SYNC_STATUS register controls various HW IRQ sources for\nthe output timing generator (OTG). VUPDATE_NO_LOCK is one of them.\n\nTo enable the IRQ, driver sets the VUPDATE_NO_LOCK_EN bit in the\nGLOBAL_SYNC_STATUS register.\n\nTo ack the IRQ after it fires, the driver sets the VUPDATE_NO_LOCK_CLEAR\nbit in the same GLOBAL_SYNC_STATUS register.\n\nThe bit sets are done through read/modify/write operations, which are\nnot atomic. Thus, the following race is possible:\n\n    Thread A:                       IRQ handler:\n                                    *HW IRQ fires*\n    # IRQ disable\n    val = read(GLOBAL_SYNC_STATUS)\n    unset(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # ACK reads VUPDATE_NO_LOCK_EN unset\n                                    val1 = read(GLOBAL_SYNC_STATUS)\n                                    set(val1, VUPDATE_NO_LOCK_CLEAR)\n    # IRQ enable\n    val = read(GLOBAL_SYNC_STATUS)\n    set(val, VUPDATE_NO_LOCK_EN)\n    write(val, GLOBAL_SYNC_STATUS)\n                                    # BAD! clears VUPDATE_NO_LOCK_EN\n                                    write(val1, GLOBAL_SYNC_STATUS)\n\nRegarding the tagged Fixes: change, it appears the change made this race\nmore likely to occur. Since VUPDATE_NO_LOCK is now the sole IRQ source\nfor vblank handling, a single race on high refresh panels can lead to a\ntime out.\n\n[How]\n\nThe GLOBAL_SYNC_STATUS register is only one example, other IRQ control\nregisters also share the same scheme. On top of GLOBAL_SYNC_STATUS,\nlet's clean up those as well.\n\nTo keep things simple, Let's atomize the IRQ rmw ops via a single\ndriver-wide spinlock. Due to the small scope of this lock, it is\nunlikely to cause noticeable overhead on top of all the existing locking\nwithin the IRQ set/handle paths.\n\nSince DM is responsible for locking, wrap dc_interrupt_set/ack with the\nspinlock in the new amdgpu_dm_irq_set/ack functions. Migrate/drop all\nreferences in DM to dc_interrupt_set/ack to use amdgpu_dm_irq_set/ack\ninstead.\n\n(cherry picked from commit 70de0a0216583a53c946155f8c8adedfdca6b4e7)",
  "id": "CVE-2026-98654",
  "modified": "2026-10-19T02:30:26.391841711Z",
  "published": "2026-10-18T15:20:25.640Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63e19ef3ddab806c472748c825f4dc88dcd994e8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98654.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98654"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "drm/amd/display: Atomize IRQ register read/modify/write ops"
}