In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Disallow unallocated resources to be returned
In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs).
To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform.
^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context.
Patchwork: https://patchwork.freedesktop.org/patch/517636/
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegraUpgrade linux-ibmUpgrade linuxUpgrade linux-gcp-5.15Upgrade linux-azureUpgrade linux-riscv-5.15Upgrade linux-azure-5.15Upgrade linux-gkeopUpgrade linux-nvidia-tegra-5.15Upgrade linux-hwe-5.15Upgrade linux-oracleUpgrade linux-raspiUpgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linux-gkeUpgrade linux-aws-5.15Upgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-lowlatencyUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-awsUpgrade linux-intel-iot-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-realtimeUpgrade linux-intel-iotg-5.15 | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub