Executive brief
A null pointer vulnerability exists in the Rockchip DRM display driver's cleanup routine. When the driver is unloaded under certain error conditions, the code attempts to access uninitialized data, causing a system crash. This affects systems using Rockchip GPUs (such as RK3588-based devices) where the DRM subsystem fails to initialize properly.
Technical details
The vulnerability is a null pointer dereference in the dw_dp_remove() function of the Rockchip DRM driver. The root cause is that the function calls platform_get_drvdata() to retrieve driver state, but this data may never have been set if the component_bind() callback fails to execute due to an earlier error in rockchip_drm_bind(). The fix removes the unsafe platform_get_drvdata() call and instead directly references the device via the platform_device structure (&pdev->dev). No user interaction or elevated privileges are required—the issue manifests when the driver probe fails partway through initialization and the remove path is invoked. The patch has been merged into the Linux kernel mainline and is available in stable kernel updates.
Affected products
- Linux Linux kernel Affected in drm/rockchip; fix applied in mainline and stable branches
Timeline
- 2026-08-28: disclosed: Published in NVD
- 2026-03-10: patched: Upstream fix committed (9456381d8b60bb7dd42f2f04afe5ee4ce6e0bc12)
- 2026-07-24: other: Merged into stable kernel tree