Executive brief
The Linux kernel's MSM display driver fails to properly reset internal bridge state when the DRM device is torn down, allowing stale pointers to deallocated memory to be accessed on subsequent device initialization attempts. This can lead to system instability, crashes, or memory corruption on devices that use Qualcomm Snapdragon display hardware and experience multiple probe deferral events (common during driver initialization with dependencies).
Technical details
This is a use-after-free vulnerability in the DRM MSM driver's device teardown path (msm_drm_uninit). The bridge counter variable (priv->num_bridges) is never reset to zero after calling drm_bridge_remove() on each bridge, causing stale pointers to deallocated bridge structures to remain in the array. On the next teardown sequence (triggered by probe deferral or device re-initialization), the code re-iterates over the same counter value, accessing memory that has been freed. With sufficient bridges, this can corrupt memory beyond the bridge array. The fix is a single-line addition to reset the counter to zero after bridge removal. The vulnerability affects multiple kernel versions from 3.12 onward and is easily exploitable on any system experiencing probe deferrals during driver load.
Affected products
- Linux Linux kernel 3.12 through at least 6.18
Timeline
- 2022-09-13: disclosed
- 2022-09-30: patched