In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: lt8912b: Fix crash on bridge detach
The lt8912b driver, in its bridge detach function, calls drm_connector_unregister() and drm_connector_cleanup().
drm_connector_unregister() should be called only for connectors explicitly registered with drm_connector_register(), which is not the case in lt8912b.
The driver's drm_connector_funcs.destroy hook is set to drm_connector_cleanup().
Thus the driver should not call either drm_connector_unregister() nor drm_connector_cleanup() in its lt8912_bridge_detach(), as they cause a crash on bridge detach:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000000858f3000 [0000000000000000] pgd=0800000085918003, p4d=0800000085918003, pud=0800000085431003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: tidss(-) display_connector lontium_lt8912b tc358768 panel_lvds panel_simple drm_dma_helper drm_kms_helper drm drm_panel_orientation_quirks CPU: 3 PID: 462 Comm: rmmod Tainted: G W 6.5.0-rc2+ #2 Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_connector_cleanup+0x78/0x2d4 [drm] lr : lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b] sp : ffff800082ed3a90 x29: ffff800082ed3a90 x28: ffff0000040c1940 x27: 0000000000000000 x26: 0000000000000000 x25: dead000000000122 x24: dead000000000122 x23: dead000000000100 x22: ffff000003fb6388 x21: 0000000000000000 x20: 0000000000000000 x19: ffff000003fb6260 x18: fffffffffffe56e8 x17: 0000000000000000 x16: 0010000000000000 x15: 0000000000000038 x14: 0000000000000000 x13: ffff800081914b48 x12: 000000000000040e x11: 000000000000015a x10: ffff80008196ebb8 x9 : ffff800081914b48 x8 : 00000000ffffefff x7 : ffff0000040c1940 x6 : ffff80007aa649d0 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff80008159e008 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: drm_connector_cleanup+0x78/0x2d4 [drm] lt8912_bridge_detach+0x54/0x6c [lontium_lt8912b] drm_bridge_detach+0x44/0x84 [drm] drm_encoder_cleanup+0x40/0xb8 [drm] drmm_encoder_alloc_release+0x1c/0x30 [drm] drm_managed_release+0xac/0x148 [drm] drm_dev_put.part.0+0x88/0xb8 [drm] devm_drm_dev_init_release+0x14/0x24 [drm] devm_action_release+0x14/0x20 release_nodes+0x5c/0x90 devres_release_all+0x8c/0xe0 device_unbind_cleanup+0x18/0x68 device_release_driver_internal+0x208/0x23c driver_detach+0x4c/0x94 bus_remove_driver+0x70/0xf4 driver_unregister+0x30/0x60 platform_driver_unregister+0x14/0x20 tidss_platform_driver_exit+0x18/0xb2c [tidss] __arm64_sys_delete_module+0x1a0/0x2b4 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x60/0x10c do_el0_svc_compat+0x1c/0x40 el0_svc_compat+0x40/0xac el0t_32_sync_handler+0xb0/0x138 el0t_32_sync+0x194/0x198 Code: 9104a276 f2fbd5b7 aa0203e1 91008af8 (f85c0420)
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade dtb-rockchipUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade dtb-xilinxUpgrade kernel-64kb-develUpgrade dtb-amlogicUpgrade dtb-nvidiaUpgrade dtb-mediatekUpgrade kernel-default-baseUpgrade kernel-develUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade ocfs2-kmp-azureUpgrade dtb-armUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-azure-develUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade kernel-obs-buildUpgrade kernel-devel-rtUpgrade dtb-apmUpgrade dtb-qcomUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-64kb-extraUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-vdsoUpgrade dtb-exynosUpgrade kernel-rt-livepatch-develUpgrade kernel-sourceUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-default-vdsoUpgrade dtb-amazonUpgrade kernel-default-develUpgrade kernel-debugUpgrade kernel-symsUpgrade dtb-lgUpgrade dtb-amdUpgrade kernel-zfcpdumpUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-caviumUpgrade kernel-rt-vdsoUpgrade dtb-appleUpgrade dtb-socionextUpgrade kernel-kvmsmallUpgrade dtb-hisiliconUpgrade kernel-debug-develUpgrade dtb-alteraUpgrade kernel-64kbUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-docs-htmlUpgrade kernel-azure-optionalUpgrade kernel-azureUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-devel-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-extraUpgrade dtb-renesasUpgrade dtb-broadcomUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade dtb-allwinner | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-igxUpgrade linux-intel-iot-realtimeUpgrade linux-gkeop-5.15Upgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-gkeUpgrade linux-ibmUpgrade linux-gcp-5.15Upgrade linux-lowlatencyUpgrade linux-riscv-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azureUpgrade linux-fipsUpgrade linux-aws-fipsUpgrade linux-hwe-5.15Upgrade linux-gcpUpgrade linux-realtimeUpgrade linux-intel-iotgUpgrade linux-oracleUpgrade linux-gkeopUpgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-azure-5.15Upgrade linux-ibm-5.15Upgrade linux-bluefieldUpgrade linuxUpgrade linux-nvidia-tegraUpgrade linux-nvidia-6.5Upgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-fdeUpgrade linux-nvidia-tegra-5.15Upgrade linux-aws-5.15Upgrade linux-aws | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub