CVE-2022-50260

published 2025-09-15

CVE-2022-50260: In the Linux kernel, the following vulnerability has been resolved: drm/msm: Make .remove and .shutdown HW shutdown consistent Drivers' .remove and .shutdown…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Make .remove and .shutdown HW shutdown consistent

Drivers' .remove and .shutdown callbacks are executed on different code
paths. The former is called when a device is removed from the bus, while
the latter is called at system shutdown time to quiesce the device.

This means that some overlap exists between the two, because both have to
take care of properly shutting down the hardware. But currently the logic
used in these two callbacks isn't consistent in msm drivers, which could
lead to kernel panic.

For example, on .remove the component is deleted and its .unbind callback
leads to the hardware being shutdown but only if the DRM device has been
marked as registered.

That check doesn't exist in the .shutdown logic and this can lead to the
driver calling drm_atomic_helper_shutdown() for a DRM device that hasn't
been properly initialized.

A situation like this can happen if drivers for expected sub-devices fail
to probe, since the .bind callback will never be executed. If that is the
case, drm_atomic_helper_shutdown() will attempt to take mutexes that are
only initialized if drm_mode_config_init() is called during a device bind.

This bug was attempted to be fixed in commit 623f279c7781 ("drm/msm: fix
shutdown hook in case GPU components failed to bind"), but unfortunately
it still happens in some cases as the one mentioned above, i.e:

systemd-shutdown[1]: Powering off.
kvm: exiting hardware virtualization
platform wifi-firmware.0: Removing from iommu group 12
platform video-firmware.0: Removing from iommu group 10
------------[ cut here ]------------
WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0
...
Hardware name: Google CoachZ (rev3+) (DT)
pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0
lr : drm_modeset_lock_all_ctx+0x48/0x3d0
sp : ffff80000805bb80
x29: ffff80000805bb80 x2

Affected

26 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.3-1 (bookworm)	linux 6.0.3-1 (bookworm)
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 4.14.197 < 4.15	4.15
linux	linux	>= 4.19.144 < 4.20	4.20
linux	linux	>= 5.4.64 < 5.5	5.5
linux	linux	>= 5.8.8 < 5.9	5.9
linux	linux	>= 9d5cbf5fe46e350715389d89d0c350d83289a102 < 26f9a766f87b33c50ed400a9500cc1dc9aced953	26f9a766f87b33c50ed400a9500cc1dc9aced953
linux	linux	>= 9d5cbf5fe46e350715389d89d0c350d83289a102 < 0e6649a2e31ac157c711d583ec8f5ec59da5de0e	0e6649a2e31ac157c711d583ec8f5ec59da5de0e
linux	linux	>= 9d5cbf5fe46e350715389d89d0c350d83289a102 < 0a58d2ae572adaec8d046f8d35b40c2c32ac7468	0a58d2ae572adaec8d046f8d35b40c2c32ac7468
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 0 < 6.0.3-1	6.0.3-1
linux	linux_kernel	>= 4.14.197 < 4.15	4.15
linux	linux_kernel	>= 4.19.144 < 4.20	4.20
linux	linux_kernel	>= 5.4.64 < 5.5	5.5
linux	linux_kernel	>= 5.8.8 < 5.9	5.9
linux	linux_kernel	>= 5.9.1 < 5.19.17	5.19.17
linux	linux_kernel	>= 6.0 < 6.0.3	6.0.3
msrc	cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0	—	—
msrc	cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0	—	—

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.