CVE-2026-90297: drm/sun4i: crtc: Propagate layer initialization error
In the Linux kernel, the following vulnerability has been resolved:
drm/sun4i: crtc: Propagate layer initialization error
sun4icrtcinit() returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4itconbind(), checks the result with ISERR() and happily continues with tcon->crtc set to NULL. sun4irgbinit() and sun4ilvdsinit() then dereference it in drmcrtcmask(), which oopses.
Return the error pointer instead.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the failure?
Layer initialization in sun4i_crtc_init() must fail. The caller then treats the NULL return as success and later RGB or LVDS initialization dereferences the unset CRTC pointer in drm_crtc_mask(), causing an oops.
Which display paths are implicated?
The reported NULL-pointer dereference occurs in the sun4i RGB and LVDS initialization paths, sun4i_rgb_init() and sun4i_lvds_init().
How can I determine whether a system is affected?
Affected systems may produce a kernel oops during display initialization when layer initialization fails and the RGB or LVDS path subsequently runs. Review kernel logs for an oops involving drm_crtc_mask() in this initialization sequence.