Executive brief
A bug in the Linux kernel's display driver (drm/msm) causes a system crash when the graphics display system fails to initialize. The driver attempts to clean up resources twice, leading to memory corruption and a potential crash. This affects systems running affected versions of the Linux kernel with MSM display hardware.
Technical details
The vulnerability is a use-after-free flaw in the drm/msm display driver's KMS (Kernel Mode Setting) initialization path. When mdp4_kms_init() or mdp5_kms_init() fails partway through, the driver cleans up state via mdp4_destroy() or mdp5_kms_destroy() before returning an error. The common error handling path in msm_drm_init() then calls msm_drm_uninit() → msm_drm_kms_uninit(), which attempts to destroy the same KMS state a second time. This double-free occurs during workqueue shutdown, as evidenced by the crash trace showing __flush_workqueue() attempting to acquire locks on already-freed structures. No user interaction or network access is required; the flaw triggers during display driver initialization failure. The fix aligns MDP4/MDP5 behavior with the DPU driver by removing error-path cleanup from the individual KMS drivers, letting the common path own all cleanup.
Affected products
- Linux Linux kernel affected versions with drm/msm MDP4/MDP5 drivers
Timeline
- 2026-09-17: disclosed