Executive brief
A vulnerability was identified in the Linux kernel's display driver for JDI panels. Under specific conditions when a display is being disconnected or removed, the system could attempt to access an invalid memory address. This could lead to a system crash or instability, potentially causing a denial of service for the affected device.
Technical details
A null-pointer dereference exists in the jdi_panel_dsi_remove() function within drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c. The code correctly identifies that the 'jdi' pointer might be NULL but fails to exit the function after handling that case. Consequently, the execution flow continues into jdi_panel_disable(), where the NULL pointer is unconditionally dereferenced to access backlight settings. This flaw is triggered during the removal of a MIPI DSI device. The fix introduces an early return when the pointer is NULL. Patches have been merged into multiple stable branches of the Linux kernel.
Affected products
- Linux Linux Kernel All versions prior to the fix in jdi_panel_dsi_remove
Timeline
- 2025-12-18: other: Patch submitted by Tuo Li
- 2026-05-08: disclosed: CVE published by NVD