Executive brief
The Linux kernel's meson display driver fails to properly clean up its aggregate device when unloading, leaving stale pointers in memory. When the driver is reloaded, these pointers are dereferenced after the underlying memory has been freed, causing a kernel crash. This affects systems using Amlogic Meson-based SoCs (commonly found in media players and single-board computers).
Technical details
The vulnerability is a use-after-free bug in the drm/meson driver's module unload path. The root cause is that component_master_del() is not called when unloading the meson_drm module, leaving the aggregate device lingering in the global aggregate_devices list. When the meson_dw_hdmi module is subsequently reloaded, component_add() triggers try_to_bring_up_aggregate_device(), which dereferences stale pointers that were freed by devres cleanup during the previous unbind. The attack vector is local (requiring module load/unload operations) and can cause a denial of service through kernel panic. A fix is available in the kernel tree that explicitly calls component_master_del() during module unload.
Affected products
- Linux Linux kernel up to 5.19-rc6 and likely later
Timeline
- 2025-10-22: disclosed