CVE-2026-74421

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/rockchip: dw_dp: Switch to drmm_kzalloc()

Driver makes use of drmm_encoder_init() to initialize the encoder and

automatically handle the cleanup by registering drm_encoder_cleanup()

with drmm_add_action().

However, the internal structure containing the encoder part gets

allocated with devm_kzalloc(), which happens while component_bind_all()

is being called from Rockchip DRM driver. The component framework

further ensures it is deallocated as part of releasing all the resources

claimed during bind, which is triggered from component_unbind_all().

When the reference to the DRM device gets eventually dropped via

drm_dev_put() in rockchip_drm_unbind(), drmm_encoder_alloc_release()

attempts to access the now released encoder structure, leading to

use-after-free.

Ensure driver's internal structure is still reachable on encoder cleanup

by switching from a device-managed allocation to a drm-managed one.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References