In the Linux kernel, the following vulnerability has been resolved:
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
vidi_connection_ioctl() retrieves the driver_data from drm_dev->dev to
obtain a struct vidi_context pointer. However, drm_dev->dev is the
exynos-drm master device, and the driver_data contained therein is not
the vidi component device, but a completely different device.
This can lead to various bugs, ranging from null pointer dereferences and
garbage value accesses to, in unlucky cases, out-of-bounds errors,
use-after-free errors, and more.
To resolve this issue, we need to store/delete the vidi device pointer in
exynos_drm_private->vidi_dev during bind/unbind, and then read this
exynos_drm_private->vidi_dev within ioctl() to obtain the correct
struct vidi_context pointer.
References
Configurations
Configuration 1 (hide)
|
History
21 Oct 2026, 13:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-05-27 14:17
Updated : 2026-10-21 13:19
NVD link : CVE-2026-45956
Mitre link : CVE-2026-45956
CVE.ORG link : CVE-2026-45956
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free