CVE-2022-49827

drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

published May 1, 2025

CVSS
—
EPSS
0%
Percentile
11.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

drm_vblank_init() call drmm_add_action_or_reset() with

drm_vblank_init_release() as action. If __drmm_add_action() failed, will

directly call drm_vblank_init_release() with the vblank whose worker is

NULL. As the resule, a null-ptr-deref will happen in

kthread_destroy_worker(). Add the NULL check before calling

drm_vblank_destroy_worker().

BUG: null-ptr-deref

KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]

CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty

RIP: 0010:kthread_destroy_worker+0x25/0xb0

Call Trace:

<TASK>

drm_vblank_init_release+0x124/0x220 [drm]

? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]

__drmm_add_action_or_reset+0x41/0x50 [drm]

drm_vblank_init+0x282/0x310 [drm]

vkms_init+0x35f/0x1000 [vkms]

? 0xffffffffc4508000

? lock_is_held_type+0xd7/0x130

? __kmem_cache_alloc_node+0x1c2/0x2b0

? lock_is_held_type+0xd7/0x130

? 0xffffffffc4508000

do_one_initcall+0xd0/0x4f0

...

do_syscall_64+0x35/0x80

entry_SYSCALL_64_after_hwframe+0x46/0xb0

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00215 · 11.3th percentile
Published
2025-05-01T14:09Z
EPSS history
Timeline
  • 01 MAY 14:09Z
    drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
    cvelistv5