Executive brief
A vulnerability was identified in the Linux kernel's Cadence DisplayPort bridge driver, which manages video output for certain hardware. Under specific error conditions during display initialization, the system may attempt to access memory that hasn't been set up yet, leading to a system crash (NULL pointer dereference). This could result in a denial of service, impacting the availability of the affected device.
Technical details
A NULL pointer dereference exists in the cdns-mhdp8546-core driver within the Linux kernel's DRM subsystem. The issue occurs because the 'connector' pointer is initialized too late in the atomic_enable() function. If an error occurs during cdns_mhdp_link_up() or cdns_mhdp_reg_read(), the driver enters a recovery path (modeset_retry_fn) that attempts to access the connector's mutex before the pointer has been assigned. This is particularly prevalent when the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag is used. An attacker with local access could potentially trigger this condition to cause a kernel panic. The fix involves moving the connector pointer assignment earlier in the atomic_enable() sequence and ensuring it is properly tracked in the device structure.
Affected products
- Linux Linux Kernel 6.6 to 7.1
Timeline
- 2026-06-24: disclosed: CVE published by NVD
- 2026-05-23: patched: Fix committed to stable kernel tree
References
- https://git.kernel.org/stable/c/1af3b42e08a957e53bab8e1897393fe0a27d9fbf
- https://git.kernel.org/stable/c/43d6508ddbf9fb974fbc359a033154f78c9d4c8b
- https://git.kernel.org/stable/c/5302015daf26ef6b48e067f2b86c9482ac19e015
- https://git.kernel.org/stable/c/a3611554e599d1a24b45fd8415bacb72ce861e4b
- https://git.kernel.org/stable/c/cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575