UBUNTU-CVE-2026-93194: Use After Free
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dwdp: Release core resources Core resources such as the DisplayPort AUX channel get initialized and registered during dwdpbind(), but are never unregistered, which may lead to memory leaks and/or use-after-free: [ 224.661371] BUG: KASAN: slab-use-after-free in deviceisdependent+0xe0/0x2b0 [ 224.662015] Read of size 8 at addr ffff00011aee8550 by task modprobe/658 [ 224.662612] [ 224.662752] CPU: 7 UID: 0 PID: 658 Comm: modprobe Not tainted 7.0.0-rc2-next-20260305 #14 PREEMPT [ 224.662759] Hardware name: Radxa ROCK 5B (DT) [ 224.662762] Call trace: [ 224.662764] showstack+0x20/0x38 (C) [ 224.662772] dumpstacklvl+0x6c/0x98 [ 224.662777] printreport+0x160/0x4b8 [ 224.662783] kasanreport+0xb4/0xe0 [ 224.662790] asanreportload8noabort+0x20/0x30 [ 224.662796] deviceisdependent+0xe0/0x2b0 [ 224.662802] deviceisdependent+0x108/0x2b0 [ 224.662808] devicelinkadd+0x1f8/0x10b0 [ 224.662813] devmofphygetbyindex+0x120/0x200 [ 224.662819] dwdpbind+0x34c/0xb10 [dwdp] [ 224.662830] dwdprockchipbind+0x194/0x250 [rockchipdrm] [ 224.662864] componentbindall+0x3a8/0x720 [ 224.662869] rockchipdrmbind+0x120/0x390 [rockchipdrm] [ 224.662899] trytobringupaggregatedevice+0x76c/0x838 [ 224.662904] componentmasteraddwithmatch+0x1f4/0x230 [ 224.662909] rockchipdrmplatformprobe+0x420/0x538 [rockchipdrm] [ 224.662939] platformprobe+0xe8/0x168 [ 224.662945] reallyprobe+0x340/0x828 [ 224.662950] driverprobedevice+0x2e0/0x350 [ 224.662954] driverprobedevice+0x80/0x140 [ 224.662959] driverattach+0x398/0x460 [ 224.662964] busforeachdev+0xe0/0x198 [ 224.662968] driverattach+0x50/0x68 [ 224.662972] busadddriver+0x2a0/0x4c0 [ 224.662977] driverregister+0x294/0x360 [ 224.662982] platformdriverregister+0x7c/0x98 [ 224.662987] rockchipdrminit+0xc4/0xff8 [rockchipdrm] Since a previous commit exported dwdpunbind() function in DW DP core library to take care of the necessary cleanup, use this in the component's unbind() callback, as well as in its bind() error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the drm/rockchip dw_dp component, call the exported dw_dp_unbind() function from the component's unbind() callback and from the bind() error path to unregister and release core resources such as the DisplayPort AUX channel.
Event History
Frequently Asked Questions
Which systems are most likely to be exposed?
Systems using an affected Ubuntu kernel package and the Rockchip DisplayPort driver are the relevant population. The reported failure occurred on a Radxa ROCK 5B device during Rockchip DRM driver binding.
What condition triggers the issue?
The issue is associated with initialization and registration of DisplayPort core resources, including the AUX channel, during dw_dp_bind() without corresponding cleanup. The supplied trace shows the use-after-free occurring while the dw_dp driver is binding during module loading.
How can I identify a possible affected system?
Look for KASAN reports indicating a slab use-after-free in device_is_dependent, with call paths involving device_link_add, dw_dp_bind, dw_dp_rockchip_bind, and rockchipdrm. Memory leaks related to unreleased DisplayPort core resources may also indicate exposure.