cbcvebase.
CVE-2024-26874
published 2024-04-17

CVE-2024-26874: In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip It's possible that…

PriorityP415medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.24%
14.9th percentile
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip It's possible that mtk_crtc->event is NULL in mtk_drm_crtc_finish_page_flip(). pending_needs_vblank value is set by mtk_crtc->event, but in mtk_drm_crtc_atomic_flush(), it's is not guarded by the same lock in mtk_drm_finish_page_flip(), thus a race condition happens. Consider the following case: CPU1 CPU2 step 1: mtk_drm_crtc_atomic_begin() mtk_crtc->event is not null, step 1: mtk_drm_crtc_atomic_flush: mtk_drm_crtc_update_config( !!mtk_crtc->event) step 2: mtk_crtc_ddp_irq -> mtk_drm_finish_page_flip: lock mtk_crtc->event set to null, pending_needs_vblank set to false unlock pending_needs_vblank set to true, step 2: mtk_crtc_ddp_irq -> mtk_drm_finish_page_flip called again, pending_needs_vblank is still true //null pointer Instead of guarding the entire mtk_drm_crtc_atomic_flush(), it's more efficient to just check if mtk_crtc->event is null before use.

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.85-1 (bookworm)linux 6.1.85-1 (bookworm)
linuxlinux
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < accdac6b71d5a2b84040c3d2234f53a60edc398eaccdac6b71d5a2b84040c3d2234f53a60edc398e
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < dfde84cc6c589f2a9f820f12426d97365670b731dfde84cc6c589f2a9f820f12426d97365670b731
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < 4688be96d20ffa49d2186523ee84f475f316fd494688be96d20ffa49d2186523ee84f475f316fd49
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < 9beec711a17245b853d64488fd5b7390316123409beec711a17245b853d64488fd5b739031612340
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < d2bd30c710475b2e29288827d2c91f9e6e2b91d7d2bd30c710475b2e29288827d2c91f9e6e2b91d7
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < a3dd12b64ae8373a41a216a0b621df224210860aa3dd12b64ae8373a41a216a0b621df224210860a
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < 9acee29a38b4d4b70f1f583e5ef9a245db4db7109acee29a38b4d4b70f1f583e5ef9a245db4db710
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < 3fc88b246a2fc16014e374040fc15af1d37525353fc88b246a2fc16014e374040fc15af1d3752535
linuxlinux>= 119f5173628aa7a0c3cf9db83460d40709e8241d < c958e86e9cc1b48cac004a6e245154dfba8e163bc958e86e9cc1b48cac004a6e245154dfba8e163b
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.85-16.1.85-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 6.7.12-16.7.12-1
linuxlinux_kernel>= 0 < 5.4.0-189.2095.4.0-189.209
linuxlinux_kernel>= 0 < 5.15.0-112.1225.15.0-112.122
linuxlinux_kernel>= 0 < 6.8.0-35.356.8.0-35.35
linuxlinux_kernel>= 4.20 < 5.4.2735.4.273
linuxlinux_kernel>= 4.7 < 4.19.3114.19.311
linuxlinux_kernel>= 5.11 < 5.15.1535.15.153
linuxlinux_kernel>= 5.16 < 6.1.836.1.83
linuxlinux_kernel>= 5.5 < 5.10.2145.10.214
linuxlinux_kernel>= 6.2 < 6.6.236.6.23

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.0HIGH
vendor_ubuntu7.0HIGH
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.