CVE-2024-26874

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip

It's possible that mtk_crtc->event is NULL in

mtk_drm_crtc_finish_page_flip().

pending_needs_vblank value is set by mtk_crtc->event, but in

mtk_drm_crtc_atomic_flush(), it's is not guarded by the same

lock in mtk_drm_finish_page_flip(), thus a race condition happens.

Consider the following case:

CPU1 CPU2

step 1:

mtk_drm_crtc_atomic_begin()

mtk_crtc->event is not null,

step 1:

mtk_drm_crtc_atomic_flush:

mtk_drm_crtc_update_config(

!!mtk_crtc->event)

step 2:

mtk_crtc_ddp_irq ->

mtk_drm_finish_page_flip:

lock

mtk_crtc->event set to null,

pending_needs_vblank set to false

unlock

pending_needs_vblank set to true,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References