drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.24 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails") where msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL); is called on gpu->pdev == NULL, as the GPU device has not been fully initialized yet. Turns out that there's more than just the aforementioned path that causes this to happen (e.g. the case when there's speedbin data in the catalog, but opp-supported-hw is missing in DT). Assigning msm_gpu->pdev earlier seems like the least painful solution to this, therefore do so. Patchwork: https://patchwork.freedesktop.org/patch/602742/
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/4a48e2e501267c8d0a9a10ada41d960ddb2dae22
- https://git.kernel.org/stable/c/542e679cd4ec93c959b014df9c31b4888e92bac8
- https://git.kernel.org/stable/c/24168aae5a5010fa7d5068a318366e847ec3ad1e
- https://git.kernel.org/stable/c/9288a9676c529ad9c856096db68fad812499bc4a
- https://git.kernel.org/stable/c/9773737375b20070ea935203fd66cb9fa17c5acb
- https://git.kernel.org/stable/c/e8ac2060597a5768e4699bb61d604b4c09927b85
- https://git.kernel.org/stable/c/16007768551d5bfe53426645401435ca8d2ef54f
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-43597
- GCVE · GCVE-0-2024-49901
CERT-FR advisories
- CERTFR-2026-AVI-0326 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0316 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0185 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0168 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0152 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0024 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 6.6.55cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.10.14cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.11 < 6.11.3
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < 4a48e2e501267c8d0a9a10ada41d960ddb2dae22 ; affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < 542e679cd4ec93c959b014df9c31b4888e92bac8 ; affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < 24168aae5a5010fa7d5068a318366e847ec3ad1e ; affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < 9288a9676c529ad9c856096db68fad812499bc4a ; affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < 9773737375b20070ea935203fd66cb9fa17c5acb ; affected 0cf6c71d70d8aa39b8fd0e39c9009602a0e0d300 < e8ac2060597a5768e4699bb61d604b4c09927b85 |
| Linux · Linux | affected 3.12 ; unaffected 0 < 3.12 ; unaffected 5.10.273 ≤ 5.10.* ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.55 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |