CVE-2022-50332

video/aperture: Call sysfb_disable() before removing PCI devices

published September 15, 2025

CVSS
—
EPSS
0%
Percentile
2.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

video/aperture: Call sysfb_disable() before removing PCI devices

Call sysfb_disable() from aperture_remove_conflicting_pci_devices()

before removing PCI devices. Without, simpledrm can still bind to

simple-framebuffer devices after the hardware driver has taken over

the hardware. Both drivers interfere with each other and results are

undefined.

Reported modesetting errors [1] are shown below.

---- snap ----

rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 7 jiffies s: 165 root: 0x2000/.

rcu: blocking rcu_node structures (internal RCU debug):

Task dump for CPU 13:

task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x00000008

Call Trace:

<TASK>

? commit_tail+0xd7/0x130

? drm_atomic_helper_commit+0x126/0x150

? drm_atomic_commit+0xa4/0xe0

? drm_plane_get_damage_clips.cold+0x1c/0x1c

? drm_atomic_helper_dirtyfb+0x19e/0x280

? drm_mode_dirtyfb_ioctl+0x10f/0x1e0

? drm_mode_getfb2_ioctl+0x2d0/0x2d0

? drm_ioctl_kernel+0xc4/0x150

? drm_ioctl+0x246/0x3f0

? drm_mode_getfb2_ioctl+0x2d0/0x2d0

? __x64_sys_ioctl+0x91/0xd0

? do_syscall_64+0x60/0xd0

? entry_SYSCALL_64_after_hwframe+0x4b/0xb5

</TASK>

...

rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 13-.... } 30 jiffies s: 169 root: 0x2000/.

rcu: blocking rcu_node structures (internal RCU debug):

Task dump for CPU 13:

task:X state:R running task stack: 0 pid: 4242 ppid: 4228 flags:0x0000400e

Call Trace:

<TASK>

? memcpy_toio+0x76/0xc0

? memcpy_toio+0x1b/0xc0

? drm_fb_memcpy_toio+0x76/0xb0

? drm_fb_blit_toio+0x75/0x2b0

? simpledrm_simple_display_pipe_update+0x132/0x150

? drm_atomic_helper_commit_planes+0xb6/0x230

? drm_atomic_helper_commit_tail+0x44/0x80

? commit_tail+0xd7/0x130

? drm_atomic_helper_commit+0x126/0x150

? drm_atomic_commit+0xa4/0xe0

? drm_plane_get_damage_clips.cold+0x1c/0x1c

? drm_atomic_helper_dirtyfb+0x19e/0x280

? drm_mode_dirtyfb_ioctl+0x10f/0x1e0

? drm_mode_getfb2_ioctl+0x2d0/0x2d0

? drm_ioctl_kernel+0xc4/0x150

? drm_ioctl+0x246/0x3f0

? drm_mode_getfb2_ioctl+0x2d0/0x2d0

? __x64_sys_ioctl+0x91/0xd0

? do_syscall_64+0x60/0xd0

? entry_SYSCALL_64_after_hwframe+0x4b/0xb5

</TASK>

The problem was added by commit 5e0137612430 ("video/aperture: Disable

and unregister sysfb devices via aperture helpers") to v6.0.3 and does

not exist in the mainline branch.

The mainline commit 5e0137612430 ("video/aperture: Disable and

unregister sysfb devices via aperture helpers") has been backported

from v6.0-rc1 to stable v6.0.3 from a larger patch series [2] that

reworks fbdev framebuffer ownership. The backport misses a change to

aperture_remove_conflicting_pci_devices(). Mainline itself is fine,

because the function does not exist there as a result of the patch

series.

Instead of backporting the whole series, fix the additional function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00138 · 2.9th percentile
Published
2025-09-15T14:49Z
EPSS history
Timeline
  • 15 SEP 14:49Z
    video/aperture: Call sysfb_disable() before removing PCI devices
    cvelistv5