CVE-2024-26909

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free

A recent DRM series purporting to simplify support for "transparent

bridges" and handling of probe deferrals ironically exposed a

use-after-free issue on pmic_glink_altmode probe deferral.

This has manifested itself as the display subsystem occasionally failing

to initialise and NULL-pointer dereferences during boot of machines like

the Lenovo ThinkPad X13s.

Specifically, the dp-hpd bridge is currently registered before all

resources have been acquired which means that it can also be

deregistered on probe deferrals.

In the meantime there is a race window where the new aux bridge driver

(or PHY driver previously) may have looked up the dp-hpd bridge and

stored a (non-reference-counted) pointer to the bridge which is about to

be deallocated.

When the display controller is later initialised, this triggers a

use-after-free when attaching the bridges:

dp -

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References