Executive brief
A vulnerability was identified in the Linux kernel's Exynos DRM driver, which manages display and graphics hardware. The driver incorrectly identified internal data structures during certain operations, which could lead to system crashes or memory corruption. In practice, this could allow a local user to cause a denial-of-service or potentially gain unauthorized access to system memory.
Technical details
The vulnerability exists within the 'vidi' component of the Exynos DRM driver (drivers/gpu/drm/exynos/exynos_drm_vidi.c). The function vidi_connection_ioctl() incorrectly used dev_get_drvdata() on the drm_dev->dev (the master device) to retrieve a struct vidi_context pointer. Because the master device's driver data points to a different structure than the vidi component, this type confusion leads to invalid memory access. Depending on the memory layout, this can manifest as a null pointer dereference, garbage value access, out-of-bounds (OOB) error, or use-after-free (UAF). The fix involves explicitly storing the vidi device pointer in the exynos_drm_private structure during the bind phase and retrieving it correctly during IOCTL calls.
Affected products
- Linux Linux Kernel All versions prior to the fix in the Exynos DRM driver
Timeline
- 2026-05-27: disclosed: Initial disclosure and publication of the CVE record.
- 2026-05-27: patched: Patches were merged into various stable branches of the Linux kernel.
References
- https://git.kernel.org/stable/c/21ca24ba51a2c28bcc4df9d7e5a40b0eb66ab76d
- https://git.kernel.org/stable/c/2987642c5213508c6c9e718324c0d5289a92c474
- https://git.kernel.org/stable/c/65d1213baffa363f2eb1117b1dc7acc573b890f8
- https://git.kernel.org/stable/c/875fa28690e93ed5296c31d3344556c6bb867234
- https://git.kernel.org/stable/c/a540f767642f75240a6c35f6a65b69e44cfcea9d
- https://git.kernel.org/stable/c/b5fc86d753dd4c281a943b92f0eef02d31af03d7
- https://git.kernel.org/stable/c/d3968a0d85b211e197f2f4f06268a7031079e0d0