{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26909", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.188Z", "datePublished": "2024-04-17T10:27:55.462Z", "dateUpdated": "2026-08-05T11:28:14.867Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:28:14.867Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: qcom: pmic_glink_altmode: fix drm bridge use-after-free\n\nA recent DRM series purporting to simplify support for \"transparent\nbridges\" and handling of probe deferrals ironically exposed a\nuse-after-free issue on pmic_glink_altmode probe deferral.\n\nThis has manifested itself as the display subsystem occasionally failing\nto initialise and NULL-pointer dereferences during boot of machines like\nthe Lenovo ThinkPad X13s.\n\nSpecifically, the dp-hpd bridge is currently registered before all\nresources have been acquired which means that it can also be\nderegistered on probe deferrals.\n\nIn the meantime there is a race window where the new aux bridge driver\n(or PHY driver previously) may have looked up the dp-hpd bridge and\nstored a (non-reference-counted) pointer to the bridge which is about to\nbe deallocated.\n\nWhen the display controller is later initialised, this triggers a\nuse-after-free when attaching the bridges:\n\n\tdp -> aux -> dp-hpd (freed)\n\nwhich may, for example, result in the freed bridge failing to attach:\n\n\t[drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@0/phy@88eb000 to encoder TMDS-31: -16\n\nor a NULL-pointer dereference:\n\n\tUnable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n\t...\n\tCall trace:\n\t drm_bridge_attach+0x70/0x1a8 [drm]\n\t drm_aux_bridge_attach+0x24/0x38 [aux_bridge]\n\t drm_bridge_attach+0x80/0x1a8 [drm]\n\t dp_bridge_init+0xa8/0x15c [msm]\n\t msm_dp_modeset_init+0x28/0xc4 [msm]\n\nThe DRM bridge implementation is clearly fragile and implicitly built on\nthe assumption that bridges may never go away. In this case, the fix is\nto move the bridge registration in the pmic_glink_altmode driver to\nafter all resources have been looked up.\n\nIncidentally, with the new dp-hpd bridge implementation, which registers\nchild devices, this is also a requirement due to a long-standing issue\nin driver core that can otherwise lead to a probe deferral loop (see\ncommit fbc35b45f9f6 (\"Add documentation on meaning of -EPROBE_DEFER\")).\n\n[DB: slightly fixed commit message by adding the word 'commit']" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is a Qualcomm SoC auxiliary-bus driver reached only through in-kernel device probing on the local machine; there is no network, adjacent-network, or remote-peer data path to `pmic_glink_altmode_probe()` or the DRM bridge chain. Local presence on the affected Qualcomm platform is the most severe reasonable vector.\nAC:H - The use-after-free only manifests when the altmode probe hits `-EPROBE_DEFER` after another driver has already cached the dp-hpd bridge pointer — a boot-time driver load/probe-ordering window the attacker cannot influence from either side, which is why the commit reports it failing only \"occasionally\". It is additionally confined to specific Qualcomm SoC hardware with `CONFIG_QCOM_PMIC_GLINK` altmode support.\nPR:L - There is no unauthenticated entry point, so PR:N is not defensible; conversely the flaw fires spontaneously during boot without any privileged action, so the low-privilege local floor is the appropriate and higher-severity choice over PR:H.\nUI:N - The condition arises autonomously during kernel device probing and display-subsystem initialisation at boot; no victim must open a file, mount media, or plug in a cable for the stale bridge pointer to be dereferenced.\nS:U - The freed object, the dangling pointer, and the corrupted control flow all live in kernel address space under the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free: `drm_bridge_attach()` reads `bridge->dev`, `bridge->of_node`, and the entire `bridge->funcs` table out of the freed `drm_aux_hpd_bridge_data` slab object, so reallocated heap contents are read back and can be leveraged for disclosure of kernel memory.\nI:H - The same path writes into freed memory (`bridge->dev`, `bridge->encoder`, and a `list_add()` on `bridge->chain_node`, which also corrupts adjacent list pointers) and then performs an indirect call through `bridge->funcs->attach` read from that freed allocation — a control-flow-hijack primitive if the slab object is reallocated.\nA:H - The commit documents a reproducible kernel oops — \"Unable to handle kernel NULL pointer dereference\" with a `drm_bridge_attach`/`drm_aux_bridge_attach` call trace — plus outright failure of the display subsystem to initialise, both of which are High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/soc/qcom/pmic_glink_altmode.c" ], "versions": [ { "version": "080b4e24852b1d5b66929f69344e6c3eeb963941", "lessThan": "2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342", "status": "affected", "versionType": "git" }, { "version": "080b4e24852b1d5b66929f69344e6c3eeb963941", "lessThan": "ef45aa2841e15b649e5417fe3d4de395fe462781", "status": "affected", "versionType": "git" }, { "version": "080b4e24852b1d5b66929f69344e6c3eeb963941", "lessThan": "b979f2d50a099f3402418d7ff5f26c3952fb08bb", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/soc/qcom/pmic_glink_altmode.c" ], "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.23", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7.11", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.23" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.7.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342" }, { "url": "https://git.kernel.org/stable/c/ef45aa2841e15b649e5417fe3d4de395fe462781" }, { "url": "https://git.kernel.org/stable/c/b979f2d50a099f3402418d7ff5f26c3952fb08bb" } ], "title": "soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:21:05.481Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/2bbd65c6ca567ed8dbbfc4fb945f57ce64bef342", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/ef45aa2841e15b649e5417fe3d4de395fe462781", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/b979f2d50a099f3402418d7ff5f26c3952fb08bb", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-08-15T19:23:05.370313Z", "id": "CVE-2024-26909", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:23:14.445Z" } } ] } }