Linux Kernel Double Free Vulnerability in AMD GPU Reset Handling

A double free vulnerability has been identified in the Linux kernel's handling of AMD graphics processing unit (GPU) resets) on Display Core (DC) streams. This issue arises because the reset process clears link encoder assignments while freeing an extra reference held by the encoder interface. However, the backup state, which is created before the reset, still contains valid assignments. After the reset, the link encoder assignments need to be cleared again, but this process inadvertently leads to a double free, causing a null pointer dereference.

Impact

Exploitation of this vulnerability leads to a double free condition, which can commonly result in a use-after-free scenario, allowing for arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by initiating a GPU reset on AMD hardware using the Display Core (DC) framework. During this process, the link encoder assignments are cleared, and the extra stream reference is freed. After the reset, the new assignments are copied, but the backup still contains valid links, leading to a double free when the assignments are cleared again.