CVE-2024-26607

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26607
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26607.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26607
Downstream
Related
Published
2024-02-29T11:47:26Z
Modified
2025-10-21T18:47:56.436211Z
Summary
drm/bridge: sii902x: Fix probing race issue
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: sii902x: Fix probing race issue

A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge:

[ 53.271356] sii902xgetedid+0x34/0x70 [sii902x] [ 53.276066] sii902xbridgegetedid+0x14/0x20 [sii902x] [ 53.281381] drmbridgegetedid+0x20/0x34 [drm] [ 53.286305] drmbridgeconnectorgetmodes+0x8c/0xcc [drmkmshelper] [ 53.292955] drmhelperprobesingleconnectormodes+0x190/0x538 [drmkmshelper] [ 53.300510] drmclientmodesetprobe+0x1f0/0xbd4 [drm] [ 53.305958] _drmfbhelperinitialconfigandunlock+0x50/0x510 [drmkmshelper] [ 53.313611] drmfbhelperinitialconfig+0x48/0x58 [drmkmshelper] [ 53.320039] drmfbdevdmaclienthotplug+0x84/0xd4 [drmdmahelper] [ 53.326401] drmclientregister+0x5c/0xa0 [drm] [ 53.331216] drmfbdevdmasetup+0xc8/0x13c [drmdmahelper] [ 53.336881] tidssprobe+0x128/0x264 [tidss] [ 53.341174] platformprobe+0x68/0xc4 [ 53.344841] reallyprobe+0x188/0x3c4 [ 53.348501] _driverprobedevice+0x7c/0x16c [ 53.352854] driverprobedevice+0x3c/0x10c [ 53.357033] _deviceattachdriver+0xbc/0x158 [ 53.361472] busforeachdrv+0x88/0xe8 [ 53.365303] _deviceattach+0xa0/0x1b4 [ 53.369135] deviceinitialprobe+0x14/0x20 [ 53.373314] busprobedevice+0xb0/0xb4 [ 53.377145] deferredprobeworkfunc+0xcc/0x124 [ 53.381757] processonework+0x1f0/0x518 [ 53.385770] workerthread+0x1e8/0x3dc [ 53.389519] kthread+0x11c/0x120 [ 53.392750] retfromfork+0x10/0x20

The issue here is as follows:

  • tidss probes, but is deferred as sii902x is still missing.
  • sii902x starts probing and enters sii902x_init().
  • sii902x calls drmbridgeadd(). Now the sii902x bridge is ready from DRM's perspective.
  • sii902x calls sii902xaudiocodecinit() and platformdeviceregisterdata()
  • The registration of the audio platform device causes probing of the deferred devices.
  • tidss probes, which eventually causes sii902xbridgeget_edid() to be called.
  • sii902xbridgeget_edid() tries to use the i2c to read the edid. However, the sii902x driver has not set up the i2c part yet, leading to the crash.

Fix this by moving the drmbridgeadd() to the end of the sii902xinit(), which is also at the very end of sii902xprobe().

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
21d808405fe49028036932dd969920f4fee4f481
Fixed
e0f83c234ea7a3dec1f84e5d02caa1c51664a076
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
21d808405fe49028036932dd969920f4fee4f481
Fixed
56f96cf6eb11a1c2d594367c3becbfb06a855ec1
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
21d808405fe49028036932dd969920f4fee4f481
Fixed
2a4c6af7934a7b4c304542c38fee35e09cc1770c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
21d808405fe49028036932dd969920f4fee4f481
Fixed
08ac6f132dd77e40f786d8af51140c96c6d739c9

Affected versions

v4.*

v4.20
v4.20-rc2
v4.20-rc3
v4.20-rc4
v4.20-rc5
v4.20-rc6
v4.20-rc7

v5.*

v5.0
v5.0-rc1
v5.0-rc2
v5.0-rc3
v5.0-rc4
v5.0-rc5
v5.0-rc6
v5.0-rc7
v5.0-rc8
v5.1
v5.1-rc1
v5.1-rc2
v5.1-rc3
v5.1-rc4
v5.1-rc5
v5.1-rc6
v5.1-rc7
v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.2
v5.2-rc1
v5.2-rc2
v5.2-rc3
v5.2-rc4
v5.2-rc5
v5.2-rc6
v5.2-rc7
v5.3
v5.3-rc1
v5.3-rc2
v5.3-rc3
v5.3-rc4
v5.3-rc5
v5.3-rc6
v5.3-rc7
v5.3-rc8
v5.4
v5.4-rc1
v5.4-rc2
v5.4-rc3
v5.4-rc4
v5.4-rc5
v5.4-rc6
v5.4-rc7
v5.4-rc8
v5.5
v5.5-rc1
v5.5-rc2
v5.5-rc3
v5.5-rc4
v5.5-rc5
v5.5-rc6
v5.5-rc7
v5.6
v5.6-rc1
v5.6-rc2
v5.6-rc3
v5.6-rc4
v5.6-rc5
v5.6-rc6
v5.6-rc7
v5.7
v5.7-rc1
v5.7-rc2
v5.7-rc3
v5.7-rc4
v5.7-rc5
v5.7-rc6
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.8
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "186387787977832682903572121598949488249",
                "118474903143583672262512702106438256017",
                "130003174101599648389404901884016486938",
                "44650164297364526522897680622234756919",
                "222982495111737581839631994919029121698",
                "17587926318342294935264152275159477287",
                "107554116343857637615108975529412003512",
                "169927200783597787598796602804826015668",
                "216393082677337128479756848038726299601",
                "8663042990405424537229844464102916704",
                "313698497557028828501454200358454920416",
                "150349569501397985032459696668675665506",
                "21832005832464749609204097111447792896",
                "245101694188912992266633823345053491213",
                "288350673263781273834636850952134164047",
                "62815617485611707382603778713148549254",
                "121454188614072691707100433003960489892",
                "159301721423135854734566455981668138995",
                "95558434360651512938941848811098630702",
                "122383391561707161827989746404421699214",
                "229493014996938903576179810552531947710"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-04fc3cab",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ac6f132dd77e40f786d8af51140c96c6d739c9"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "186387787977832682903572121598949488249",
                "118474903143583672262512702106438256017",
                "130003174101599648389404901884016486938",
                "44650164297364526522897680622234756919",
                "222982495111737581839631994919029121698",
                "17587926318342294935264152275159477287",
                "107554116343857637615108975529412003512",
                "169927200783597787598796602804826015668",
                "216393082677337128479756848038726299601",
                "8663042990405424537229844464102916704",
                "313698497557028828501454200358454920416",
                "150349569501397985032459696668675665506",
                "21832005832464749609204097111447792896",
                "245101694188912992266633823345053491213",
                "288350673263781273834636850952134164047",
                "62815617485611707382603778713148549254",
                "121454188614072691707100433003960489892",
                "159301721423135854734566455981668138995",
                "95558434360651512938941848811098630702",
                "122383391561707161827989746404421699214",
                "229493014996938903576179810552531947710"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-3ba8fd2c",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56f96cf6eb11a1c2d594367c3becbfb06a855ec1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "225579769485797703115472622239797475389",
            "length": 1547.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_init"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-47e132b6",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0f83c234ea7a3dec1f84e5d02caa1c51664a076"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "225579769485797703115472622239797475389",
            "length": 1547.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_init"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-591f106c",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ac6f132dd77e40f786d8af51140c96c6d739c9"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "186387787977832682903572121598949488249",
                "118474903143583672262512702106438256017",
                "130003174101599648389404901884016486938",
                "44650164297364526522897680622234756919",
                "222982495111737581839631994919029121698",
                "17587926318342294935264152275159477287",
                "107554116343857637615108975529412003512",
                "169927200783597787598796602804826015668",
                "216393082677337128479756848038726299601",
                "8663042990405424537229844464102916704",
                "313698497557028828501454200358454920416",
                "150349569501397985032459696668675665506",
                "163530883467623927007397764196668271479",
                "329801896985653439119636538929857327856",
                "288350673263781273834636850952134164047",
                "62815617485611707382603778713148549254",
                "121454188614072691707100433003960489892",
                "159301721423135854734566455981668138995",
                "95558434360651512938941848811098630702",
                "122383391561707161827989746404421699214",
                "229493014996938903576179810552531947710"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-7073f99a",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0f83c234ea7a3dec1f84e5d02caa1c51664a076"
    },
    {
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "186387787977832682903572121598949488249",
                "118474903143583672262512702106438256017",
                "130003174101599648389404901884016486938",
                "44650164297364526522897680622234756919",
                "222982495111737581839631994919029121698",
                "17587926318342294935264152275159477287",
                "107554116343857637615108975529412003512",
                "169927200783597787598796602804826015668",
                "216393082677337128479756848038726299601",
                "8663042990405424537229844464102916704",
                "313698497557028828501454200358454920416",
                "150349569501397985032459696668675665506",
                "21832005832464749609204097111447792896",
                "245101694188912992266633823345053491213",
                "288350673263781273834636850952134164047",
                "62815617485611707382603778713148549254",
                "121454188614072691707100433003960489892",
                "159301721423135854734566455981668138995",
                "95558434360651512938941848811098630702",
                "122383391561707161827989746404421699214",
                "229493014996938903576179810552531947710"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-73b3c10a",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a4c6af7934a7b4c304542c38fee35e09cc1770c"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "29176163798716837368764648116922131734",
            "length": 138.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_remove"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-abeb0d08",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0f83c234ea7a3dec1f84e5d02caa1c51664a076"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "29176163798716837368764648116922131734",
            "length": 138.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_remove"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-b6a586e9",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@08ac6f132dd77e40f786d8af51140c96c6d739c9"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "29176163798716837368764648116922131734",
            "length": 138.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_remove"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-c81986c9",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56f96cf6eb11a1c2d594367c3becbfb06a855ec1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "29176163798716837368764648116922131734",
            "length": 138.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_remove"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-cc6a9c24",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a4c6af7934a7b4c304542c38fee35e09cc1770c"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "225579769485797703115472622239797475389",
            "length": 1547.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_init"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-d0695447",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@56f96cf6eb11a1c2d594367c3becbfb06a855ec1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "225579769485797703115472622239797475389",
            "length": 1547.0
        },
        "target": {
            "file": "drivers/gpu/drm/bridge/sii902x.c",
            "function": "sii902x_init"
        },
        "signature_version": "v1",
        "id": "CVE-2024-26607-efec59f3",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a4c6af7934a7b4c304542c38fee35e09cc1770c"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
6.1.76
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.15
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.3