CVE-2026-68429: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
In the Linux kernel, the following vulnerability has been resolved:
drm/dpmst: Handle torn-down topology gracefully in drmdpmsttopologyqueueprobe()
A hotplug or link-loss event can tear down the MST topology (setting mgr->mststate = false and mgr->mstprimary = NULL) concurrently with a caller invoking drmdpmsttopologyqueueprobe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired.
Replace the drmWARNON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drmdbgmst() trace is added so the skipped probe remains observable under MST debug logging.
The existing WARNON(mgr->mstprimary) in drmdpmsttopologymgrsetmst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In drm_dp_mst_topology_mgr_set_mst(), replace the existing WARN_ON(mgr->mst_primary) check with a graceful early return so torn-down MST topology is handled without spurious kernel warnings and compositor crashes.
Linux kernel DRM DP MST Replace drm_WARN_ON() with a graceful early return = enabled (graceful return instead of WARN_ON) - Configuration
In drm_dp_mst_topology_queue_probe(), add handling for torn-down MST topology so that if the topology was valid when the caller decided but tore down before acquiring mgr->lock, the probe is skipped gracefully while remaining observable under MST debug logging.
Linux kernel DRM DP MST drm_dp_mst_topology_queue_probe probe handling = skip probe with MST debug visibility (under torn-down topology race)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68429?
CVE-2026-68429 has a risk rating of 23, indicating it poses a significant security threat.
How do I fix CVE-2026-68429?
To fix CVE-2026-68429, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-68429?
CVE-2026-68429 is related to the handling of torn-down display topology in the Linux kernel's DRM subsystem.
Who is affected by CVE-2026-68429?
Users of affected versions of the Linux kernel that utilize DisplayPort MST technology may be impacted by CVE-2026-68429.
When was CVE-2026-68429 published?
CVE-2026-68429 was published on August 12, 2026.