Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-45956

drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.114, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl() vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to obtain a struct vidi_context pointer. However, drm_dev->dev is the exynos-drm master device, and the driver_data contained therein is not the vidi component device, but a completely different device. This can lead to various bugs, ranging from null pointer dereferences and garbage value accesses to, in unlucky cases, out-of-bounds errors, use-after-free errors, and more. To resolve this issue, we need to store/delete the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind, and then read this exynos_drm_private->vidi_dev within ioctl() to obtain the correct struct vidi_context pointer.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in 2987642c5213508c6c9e718324c0d5289a92c474; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in 65d1213baffa363f2eb1117b1dc7acc573b890f8; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in 875fa28690e93ed5296c31d3344556c6bb867234; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in 21ca24ba51a2c28bcc4df9d7e5a40b0eb66ab76d; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in e1aed617eb80b49eac2f8c7bb7a0990f641dd59b; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in b5fc86d753dd4c281a943b92f0eef02d31af03d7; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in a540f767642f75240a6c35f6a65b69e44cfcea9d; From cf67cc9a29ac19c98bc4fa0e6d14b0c1f592d322 · fixed in d3968a0d85b211e197f2f4f06268a7031079e0d0

  • Linux Linux

    4.3

  • KernelLinux

    From 4.3.0 · fixed in 5.10.253; From 5.11.0 · fixed in 5.15.203; From 5.16.0 · fixed in 6.1.167; From 6.2.0 · fixed in 6.6.130; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.14; From 6.19.0 · fixed in 6.19.4

References 8

git.kernel.org