CVE-2022-50398

published 2025-09-18

CVE-2022-50398: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: add atomic_check to bridge ops DRM commit_tails() will disable downstream…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: add atomic_check to bridge ops

DRM commit_tails() will disable downstream crtc/encoder/bridge if
both disable crtc is required and crtc->active is set before pushing
a new frame downstream.

There is a rare case that user space display manager issue an extra
screen update immediately followed by close DRM device while down
stream display interface is disabled. This extra screen update will
timeout due to the downstream interface is disabled but will cause
crtc->active be set. Hence the followed commit_tails() called by
drm_release() will pass the disable downstream crtc/encoder/bridge
conditions checking even downstream interface is disabled.
This cause the crash to happen at dp_bridge_disable() due to it trying
to access the main link register to push the idle pattern out while main
link clocks is disabled.

This patch adds atomic_check to prevent the extra frame will not
be pushed down if display interface is down so that crtc->active
will not be set neither. This will fail the conditions checking
of disabling down stream crtc/encoder/bridge which prevent
drm_release() from calling dp_bridge_disable() so that crash
at dp_bridge_disable() prevented.

There is no protection in the DRM framework to check if the display
pipeline has been already disabled before trying again. The only
check is the crtc_state->active but this is controlled by usermode
using UAPI. Hence if the usermode sets this and then crashes, the
driver needs to protect against double disable.

SError Interrupt on CPU7, code 0x00000000be000411 -- SError
CPU: 7 PID: 3878 Comm: Xorg Not tainted 5.19.0-stb-cbq #19
Hardware name: Google Lazor (rev3 - 8) (DT)
pstate: a04000c9 (NzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __cmpxchg_case_acq_32+0x14/0x2c
lr : do_raw_spin_lock+0xa4/0xdc
sp : ffffffc01092b6a0
x29: ffffffc01092b6a0 x28: 0000000000000028 x27: 0000000000000038
x26: 0000000000000004 x25: ffffffd2973dce48 x24:

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.0.7-1 (bookworm)	linux 6.0.7-1 (bookworm)
linux	linux	—	—
linux	linux	>= 8a3b4c17f863cde8e8743edd8faffe916c49b960 < d106b866439c63a618d020477bfbe7b46c759657	d106b866439c63a618d020477bfbe7b46c759657
linux	linux	>= 8a3b4c17f863cde8e8743edd8faffe916c49b960 < 3a661247967a6f3c99a95a8ba4c8073c5846ea4b	3a661247967a6f3c99a95a8ba4c8073c5846ea4b
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 0 < 6.0.7-1	6.0.7-1
linux	linux_kernel	>= 5.17 < 6.0.7	6.0.7

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.