Linux Kernel Adreno Driver NULL Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's Adreno graphics driver (for A2XX to A4XX generations) can lead to a userspace-triggered crash. The issue arises because the driver does not fetch Unified Bandwidth Compression (UBWC) parameters for these older generations, yet it still allows querying of UBWC-related parameters from userspace. This can trigger a NULL pointer dereference. The vulnerability has been addressed by adding a check for UBWC configuration in the 'adreno_get_param()' function and returning safe default values when none are available.

Impact

Exploitation of this vulnerability can cause a NULL pointer dereference, leading to a crash of the affected system.

Reproduction

To reproduce this vulnerability, query UBWC-related parameters from userspace while running a Linux kernel version that includes this vulnerability. The Adreno driver for A2XX to A4XX generations will not fetch UBWC parameters, but the query will still be processed, resulting in a NULL pointer dereference and a crash.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.