CVE-2024-57798

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

State: Published
Severity: 7.8 High
Published: Jan 11, 2025
Updated: May 11, 2026
Reserved: Jan 11, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could be removed from another thread via drm_dp_mst_topology_mgr_set_mst(false), freeing mst_primary and setting drm_dp_mst_topology_mgr::mst_primary to NULL. This could lead to a NULL deref/use-after-free of mst_primary in drm_dp_mst_handle_up_req().

Avoid the above by holding a reference for mst_primary in drm_dp_mst_handle_up_req() while it's used.

v2: Fix kfreeing the request if getting an mst_primary reference fails.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	9408cc94eb041d0c2f9f00189a613b94c0449450 to before f61b2e5e7821f868d6afc22382a66a30ee780ba0Affected 9408cc94eb041d0c2f9f00189a613b94c0449450 to before 9735d40f5fde9970aa46e828ecc85c32571d58a2Affected 9408cc94eb041d0c2f9f00189a613b94c0449450 to before ce55818b2d3a999f886af91679589e4644ff1dc8Affected 9408cc94eb041d0c2f9f00189a613b94c0449450 to before e54b00086f7473dbda1a7d6fc47720ced157c6a8Affected
LinuxLinux	5.5Affected before 5.5Not affected 6.1.123 through 6.1.Not affected 6.6.69 through 6.6.Not affected 6.12.8 through 6.12.*Not affected 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.