CVE-2026-93194: drm/rockchip: dw_dp: Release core resources
In the Linux kernel, the following vulnerability has been resolved:
drm/rockchip: dwdp: Release core resources
Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind(), but are never unregistered, which may lead to memory leaks and/or use-after-free:
[ 224.661371] BUG: KASAN: slab-use-after-free in deviceisdependent+0xe0/0x2b0 [ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658 [ 224.662612] [ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT [ 224.662759] Hardware name: Radxa ROCK 5B (DT) [ 224.662762] Call trace: [ 224.662764] showstack+0x20/0x38 (C) [ 224.662772] dumpstacklvl+0x6c/0x98 [ 224.662777] printreport+0x160/0x4b8 [ 224.662783] kasanreport+0xb4/0xe0 [ 224.662790] asanreportload8noabort+0x20/0x30 [ 224.662796] deviceisdependent+0xe0/0x2b0 [ 224.662802] deviceisdependent+0x108/0x2b0 [ 224.662808] devicelinkadd+0x1f8/0x10b0 [ 224.662813] devmofphygetbyindex+0x120/0x200 [ 224.662819] dwdpbind+0x34c/0xb10 [dwdp] [ 224.662830] dwdprockchipbind+0x194/0x250 [rockchipdrm] [ 224.662864] componentbindall+0x3a8/0x720 [ 224.662869] rockchipdrmbind+0x120/0x390 [rockchipdrm] [ 224.662899] trytobringupaggregatedevice+0x76c/0x838 [ 224.662904] componentmasteraddwithmatch+0x1f4/0x230 [ 224.662909] rockchipdrmplatformprobe+0x420/0x538 [rockchipdrm] [ 224.662939] platformprobe+0xe8/0x168 [ 224.662945] reallyprobe+0x340/0x828 [ 224.662950] driverprobedevice+0x2e0/0x350 [ 224.662954] driverprobedevice+0x80/0x140 [ 224.662959] driverattach+0x398/0x460 [ 224.662964] busforeachdev+0xe0/0x198 [ 224.662968] driverattach+0x50/0x68 [ 224.662972] busadddriver+0x2a0/0x4c0 [ 224.662977] driverregister+0x294/0x360 [ 224.662982] platformdriverregister+0x7c/0x98 [ 224.662987] rockchipdrminit+0xc4/0xff8 [rockchipdrm]
Since a previous commit exported dwdpunbind() function in DW DP core library to take care of the necessary cleanup, use this in the component's unbind() callback, as well as in its bind() error path.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely exposed to this issue?
Systems using the Linux kernel's Rockchip DRM DisplayPort driver path are implicated, specifically the dw_dp component. The reported failure occurred on a Radxa ROCK 5B device during driver binding.
When can the use-after-free occur?
The issue can occur after dw_dp_bind() initializes and registers core resources, including the DisplayPort AUX channel, without unregistering them. A later bind or dependency operation can access stale resources, as shown by the reported use-after-free during modprobe.
What is the remediation?
Apply a Linux kernel update containing the relevant stable fixes referenced for this issue. The fix releases the core resources that were initialized and registered during dw_dp_bind().