CVE-2024-26909
published 2024-04-17CVE-2024-26909: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series purporting…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series purporting to simplify support for "transparent
bridges" and handling of probe deferrals ironically exposed a
use-after-free issue on pmic_glink_altmode probe deferral.
This has manifested itself as the display subsystem occasionally failing
to initialise and NULL-pointer dereferences during boot of machines like
the Lenovo ThinkPad X13s.
Specifically, the dp-hpd bridge is currently registered before all
resources have been acquired which means that it can also be
deregistered on probe deferrals.
In the meantime there is a race window where the new aux bridge driver
(or PHY driver previously) may have looked up the dp-hpd bridge and
stored a (non-reference-counted) pointer to the bridge which is about to
be deallocated.
When the display controller is later initialised, this triggers a
use-after-free when attaching the bridges:
dp -> aux -> dp-hpd (freed)
which may, for example, result in the freed bridge failing to attach:
[drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@0/phy@88eb000 to encoder TMDS-31: -16
or a NULL-pointer dereference:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
...
Call trace:
drm_bridge_attach+0x70/0x1a8 [drm]
drm_aux_bridge_attach+0x24/0x38 [aux_bridge]
drm_bridge_attach+0x80/0x1a8 [drm]
dp_bridge_init+0xa8/0x15c [msm]
msm_dp_modeset_init+0x28/0xc4 [msm]
The DRM bridge implementation is clearly fragile and implicitly built on
the assumption that bridges may never go away. In this case, the fix is
to move the bridge registration in the pmic_glink_altmode driver to
after all resources have been looked up.
Incidentally, with the new dp-hpd bridge implementation, which registers
child devices, this is also a requirement due to a long-standing issue
in driver core that can otherwise lead to a probe deferral loop (see
commit fbc35b4
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.7.12-1 (forky) | linux 6.7.12-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 080b4e24852b1d5b66929f69344e6c3eeb963941 < 2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342 | 2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342 |
| linux | linux | >= 080b4e24852b1d5b66929f69344e6c3eeb963941 < ef45aa2841e15b649e5417fe3d4de395fe462781 | ef45aa2841e15b649e5417fe3d4de395fe462781 |
| linux | linux | >= 080b4e24852b1d5b66929f69344e6c3eeb963941 < b979f2d50a099f3402418d7ff5f26c3952fb08bb | b979f2d50a099f3402418d7ff5f26c3952fb08bb |
| linux | linux_kernel | >= 0 < 6.7.12-1 | 6.7.12-1 |
| linux | linux_kernel | >= 0 < 6.7.12-1 | 6.7.12-1 |
| linux | linux_kernel | >= 6.3 < 6.6.23 | 6.6.23 |
| linux | linux_kernel | >= 6.7 < 6.7.11 | 6.7.11 |
| msrc | azl3_kernel_6.6.22.1-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.29.1-3_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
vendor_redhat·2024-04-17·CVSS 5.5
CVE-2024-26909 [MEDIUM] CWE-416 kernel: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
kernel: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series purporting to simplify support for "transparent
bridges" and handling of probe deferrals ironically exposed a
use-after-free issue on pmic_glink_altmode probe deferral.
This has manifested itself as the display subsystem occasionally failing
to initialise and NULL-pointer dereferences during boot of machines like
the Lenovo ThinkPad X13s.
Specifically, the dp-hpd bridge is currently registered before all
resources have been acquired which means that it can also be
deregistered on probe deferrals.
In the meantime there is a race window where the new aux bridge driver
(or PHY
Microsoft
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
vendor_msrc·2024-04-09·CVSS 5.5
CVE-2024-26909 [MEDIUM] CWE-416 soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://
Debian
CVE-2024-26909: linux - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ...
vendor_debian·2024·CVSS 5.5
CVE-2024-26909 [MEDIUM] CVE-2024-26909: linux - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: ...
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series purporting to simplify support for "transparent bridges" and handling of probe deferrals ironically exposed a use-after-free issue on pmic_glink_altmode probe deferral. This has manifested itself as the display subsystem occasionally failing to initialise and NULL-pointer dereferences during boot of machines like the Lenovo ThinkPad X13s. Specifically, the dp-hpd bridge is currently registered before all resources have been acquired which means that it can also be deregistered on probe deferrals. In the meantime there is a race window where the new aux bridge driver (or PHY driver previously) may have looked up the dp-hpd bridge and stored a (
OSV
CVE-2024-26909: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series p
osv·2024-04-17·CVSS 5.5
CVE-2024-26909 [MEDIUM] CVE-2024-26909: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series p
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series purporting to simplify support for "transparent bridges" and handling of probe deferrals ironically exposed a use-after-free issue on pmic_glink_altmode probe deferral. This has manifested itself as the display subsystem occasionally failing to initialise and NULL-pointer dereferences during boot of machines like the Lenovo ThinkPad X13s. Specifically, the dp-hpd bridge is currently registered before all resources have been acquired which means that it can also be deregistered on probe deferrals. In the meantime there is a race window where the new aux bridge driver (or PHY driver previously) may have looked up the dp-hpd bridge and stored a (
GHSA
GHSA-gfgj-cf2r-6ffw: In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series
ghsa_unreviewed·2024-04-17
CVE-2024-26909 [MEDIUM] CWE-416 GHSA-gfgj-cf2r-6ffw: In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free
A recent DRM series purporting to simplify support for "transparent
bridges" and handling of probe deferrals ironically exposed a
use-after-free issue on pmic_glink_altmode probe deferral.
This has manifested itself as the display subsystem occasionally failing
to initialise and NULL-pointer dereferences during boot of machines like
the Lenovo ThinkPad X13s.
Specifically, the dp-hpd bridge is currently registered before all
resources have been acquired which means that it can also be
deregistered on probe deferrals.
In the meantime there is a race window where the new aux bridge driver
(or PHY driver previously) may have looked up the dp-hpd bridge and
store
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342https://git.kernel.org/stable/c/b979f2d50a099f3402418d7ff5f26c3952fb08bbhttps://git.kernel.org/stable/c/ef45aa2841e15b649e5417fe3d4de395fe462781https://git.kernel.org/stable/c/2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342https://git.kernel.org/stable/c/b979f2d50a099f3402418d7ff5f26c3952fb08bbhttps://git.kernel.org/stable/c/ef45aa2841e15b649e5417fe3d4de395fe462781
2024-04-17
Published