UBUNTU-CVE-2026-93068: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer() after the backing DM state has been torn down, leading to a NULL pointer dereference. Create a devres group around the DM I2C adapter lifetime and release it at the start of dmhwfini(), before HPD, IRQ, and DM state are torn down. This removes the I2C adapters first and waits for in-flight users to drain before the structures used by amdgpudmi2cxfer() disappear. This fixes a teardown ordering race seen during device removal: BUG: kernel NULL pointer dereference RIP: amdgpudmi2cxfer+0x122/0x1c0 [amdgpu] Call Trace: i2ctransfer i2ctransfer i2cdevioctlrdwr
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Create a devres group around the DM I2C adapter lifetime and release it at the start of dm_hw_fini(), before HPD, IRQ, and DM state are torn down, so the I2C adapters are removed first and in-flight users are allowed to drain.