CVE-2026-31562

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register

The call to mipi_dsi_host_register triggers a callback to mtk_dsi_bind,

which uses dev_get_drvdata to retrieve the mtk_dsi struct, so this

structure needs to be stored inside the driver data before invoking it.

As drvdata is currently uninitialized it leads to a crash when

registering the DSI DRM encoder right after acquiring

the mode_config.idr_mutex, blocking all subsequent DRM operations.

Fixes the following crash during mediatek-drm probe (tested on Xiaomi

Smart Clock x04g):

Unable to handle kernel NULL pointer dereference at virtual address

0000000000000040

[...]

Modules linked in: mediatek_drm(+) drm_display_helper cec drm_client_lib

drm_dma_helper drm_kms_helper panel_simple

[...]

Call trace:

drm_mode_object_add+0x58/0x98 (P)

__drm_encoder_init+0x48/0x140

drm_encoder_init+0x6c/0xa0

drm_simple_encoder_init+0x20/0x34 [drm_kms_he

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References