Executive brief
A vulnerability was identified in the Linux kernel's display driver for certain hardware backends. The issue involves a failure to properly check for errors when managing display layers, which could lead to a system crash or unpredictable behavior. This affects the stability of the operating system on devices using specific graphics hardware.
Technical details
The vulnerability exists in the sun4i_backend_atomic_check() function within drivers/gpu/drm/sun4i/sun4i_backend.c. The function calls drm_atomic_get_plane_state(), which can return an ERR_PTR under certain conditions (such as memory pressure or invalid state). The code failed to validate the return value before dereferencing it to access plane_state members. An attacker with the ability to trigger specific DRM atomic state changes could potentially cause a kernel NULL/error pointer dereference, leading to a Denial of Service (DoS). The issue has been patched by adding an IS_ERR() check and returning the appropriate error code.
Affected products
- Linux Linux Kernel 4.17 to 7.0.10
Timeline
- 2026-02-16: other: Patch authored
- 2026-06-24: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/06277983eca4a31d3c2114fa33d99a6e82484b11
- https://git.kernel.org/stable/c/47038159c559824f4dbfb5b0d87b9b3416663372
- https://git.kernel.org/stable/c/779c2f10743fc021f2f0ebe2b188cadfb973c5e4
- https://git.kernel.org/stable/c/cf615b90a11a39a28e313be5e508e94bcde72016
- https://git.kernel.org/stable/c/e9bef62f1bb9fcb38223730657af20f4c6283c16
- https://git.kernel.org/stable/c/ea51fd96aca01381e8f1ac0c671a57b7619193bb