Linux Kernel DRM MSM DPU Connector Data Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's DRM MSM DPU handling. This issue arises from mixing device-managed and driver-managed functions, which can lead to improper memory management during the teardown of the MSM driver. If userspace retains a reference to the DRM device, the writeback connector data may be prematurely destroyed, while userspace could still attempt to interact with the connector, creating a potential exploitation vector.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.

Reproduction

The vulnerability can be reproduced by initializing a writeback connector using the driver-managed function, while the userspace maintains a reference to the DRM device. This can be done by modifying the DPU writeback initialization process to use the device-managed allocation function, which will cause the connector data to be freed while still in use.

Remediation

Users can apply the available patch to address this vulnerability. The patch is included in the Linux kernel stable tree.