CVE-2024-26874: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip
It's possible that mtkcrtc->event is NULL in mtkdrmcrtcfinishpageflip().
pendingneedsvblank value is set by mtkcrtc->event, but in mtkdrmcrtcatomicflush(), it's is not guarded by the same lock in mtkdrmfinishpageflip(), thus a race condition happens.
Consider the following case:
CPU1 CPU2 step 1: mtkdrmcrtcatomicbegin() mtkcrtc->event is not null, step 1: mtkdrmcrtcatomicflush: mtkdrmcrtcupdateconfig( !!mtkcrtc->event) step 2: mtkcrtcddpirq -> mtkdrmfinishpageflip: lock mtkcrtc->event set to null, pendingneedsvblank set to false unlock pendingneedsvblank set to true,
step 2: mtkcrtcddpirq -> mtkdrmfinishpageflip called again, pendingneedsvblank is still true //null pointer
Instead of guarding the entire mtkdrmcrtcatomicflush(), it's more efficient to just check if mtkcrtc->event is null before use.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26874?
CVE-2024-26874 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26874?
To fix CVE-2024-26874, you should upgrade your Linux kernel to one of the patched versions: 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
What are the potential impacts of CVE-2024-26874?
The potential impacts of CVE-2024-26874 include a null pointer dereference which may lead to system crashes.
What components of the Linux kernel are affected by CVE-2024-26874?
CVE-2024-26874 specifically affects the Driver for MediaTek graphics within the Linux kernel.
Is CVE-2024-26874 present in specific Linux distributions?
Yes, CVE-2024-26874 is present in certain versions of the Linux package available in Debian.