CVE-2024-26728

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-26728
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26728.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26728
Downstream
Published
2024-04-03T17:00:16Z
Modified
2025-10-21T18:27:09.477353Z
Summary
drm/amd/display: fix null-pointer dereference on edid reading
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: fix null-pointer dereference on edid reading

Use i2c adapter when there isn't auxmode in dclink to fix a null-pointer derefence that happens when running igt@kmsforceconnector_basic in a system with DCN2.1 and HDMI connector detected as below:

[ +0.178146] BUG: kernel NULL pointer dereference, address: 00000000000004c0 [ +0.000010] #PF: supervisor read access in kernel mode [ +0.000005] #PF: errorcode(0x0000) - not-present page [ +0.000004] PGD 0 P4D 0 [ +0.000006] Oops: 0000 [#1] PREEMPT SMP NOPTI [ +0.000006] CPU: 15 PID: 2368 Comm: kmsforceconne Not tainted 6.5.0-asdn+ #152 [ +0.000005] Hardware name: HP HP ENVY x360 Convertible 13-ay1xxx/8929, BIOS F.01 07/14/2021 [ +0.000004] RIP: 0010:i2ctransfer+0xd/0x100 [ +0.000011] Code: ea fc ff ff 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 54 55 53 <48> 8b 47 10 48 89 fb 48 83 38 00 0f 84 b3 00 00 00 83 3d 2f 80 16 [ +0.000004] RSP: 0018:ffff9c4f89c0fad0 EFLAGS: 00010246 [ +0.000005] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000080 [ +0.000003] RDX: 0000000000000002 RSI: ffff9c4f89c0fb20 RDI: 00000000000004b0 [ +0.000003] RBP: ffff9c4f89c0fb80 R08: 0000000000000080 R09: ffff8d8e0b15b980 [ +0.000003] R10: 00000000000380e0 R11: 0000000000000000 R12: 0000000000000080 [ +0.000002] R13: 0000000000000002 R14: ffff9c4f89c0fb0e R15: ffff9c4f89c0fb0f [ +0.000004] FS: 00007f9ad2176c40(0000) GS:ffff8d90fe9c0000(0000) knlGS:0000000000000000 [ +0.000003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000004] CR2: 00000000000004c0 CR3: 0000000121bc4000 CR4: 0000000000750ee0 [ +0.000003] PKRU: 55555554 [ +0.000003] Call Trace: [ +0.000006] <TASK> [ +0.000006] ? _die+0x23/0x70 [ +0.000011] ? pagefaultoops+0x17d/0x4c0 [ +0.000008] ? preemptcountadd+0x6e/0xa0 [ +0.000008] ? srsoaliasreturnthunk+0x5/0x7f [ +0.000011] ? excpagefault+0x7f/0x180 [ +0.000009] ? asmexcpagefault+0x26/0x30 [ +0.000013] ? i2ctransfer+0xd/0x100 [ +0.000010] drmdoprobeddcedid+0xc2/0x140 [drm] [ +0.000067] ? srsoaliasreturnthunk+0x5/0x7f [ +0.000006] ? _drmdogetedid+0x97/0x3c0 [drm] [ +0.000043] ? _pfxdrmdoprobeddcedid+0x10/0x10 [drm] [ +0.000042] edidblockread+0x3b/0xd0 [drm] [ +0.000043] drmdogetedid+0xb6/0x3c0 [drm] [ +0.000041] ? _pfxdrmdoprobeddcedid+0x10/0x10 [drm] [ +0.000043] drmedidreadcustom+0x37/0xd0 [drm] [ +0.000044] amdgpudmconnectormodevalid+0x129/0x1d0 [amdgpu] [ +0.000153] drmconnectormodevalid+0x3b/0x60 [drmkmshelper] [ +0.000000] _drmhelperupdateandvalidate+0xfe/0x3c0 [drmkmshelper] [ +0.000000] ? amdgpudmconnectorgetmodes+0xb6/0x520 [amdgpu] [ +0.000000] ? srsoaliasreturnthunk+0x5/0x7f [ +0.000000] drmhelperprobesingleconnectormodes+0x2ab/0x540 [drmkmshelper] [ +0.000000] statusstore+0xb2/0x1f0 [drm] [ +0.000000] kernfsfopwriteiter+0x136/0x1d0 [ +0.000000] vfswrite+0x24d/0x440 [ +0.000000] ksyswrite+0x6f/0xf0 [ +0.000000] dosyscall64+0x60/0xc0 [ +0.000000] ? srsoaliasreturnthunk+0x5/0x7f [ +0.000000] ? syscallexittousermode+0x2b/0x40 [ +0.000000] ? srsoaliasreturnthunk+0x5/0x7f [ +0.000000] ? dosyscall64+0x6c/0xc0 [ +0.000000] ? dosyscall64+0x6c/0xc0 [ +0.000000] entrySYSCALL64afterhwframe+0x6e/0xd8 [ +0.000000] RIP: 0033:0x7f9ad46b4b00 [ +0.000000] Code: 40 00 48 8b 15 19 b3 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d e1 3a 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 [ +0.000000] RSP: 002b:00007ffcbd3bd6d8 EFLAGS: 00000202 ORIGRAX: 0000000000000001 [ +0.000000] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9ad46b4b00 [ +0.000000] RDX: 0000000000000002 RSI: 00007f9ad48a7417 RDI: 0000000000000009 [ +0.000000] RBP: 0000000000000002 R08 ---truncated---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0e859faf8670a78ce206977dcf1a31a0231e9ca5
Fixed
2d392f7268a1a9bfbd98c831f0f4c964e59aa145
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0e859faf8670a78ce206977dcf1a31a0231e9ca5
Fixed
9671761792156f2339627918bafcd713a8a6f777

Affected versions

v6.*

v6.5
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "253090052355415885411640281140503081022",
                "106455795423721013992991666224143044135",
                "275856162943962597353491702935215959132",
                "249666623944525589666613696043243528182",
                "49752601887173439187998621471950559546",
                "311931868020365882993925927439492479998",
                "6881002791937441948925581587893878542",
                "133289073956155905867404914295016656774",
                "52304933088816918198312131817798671264",
                "3825653238612370571177023512628522115",
                "18628285427106232167131090995479512445",
                "330462217778438228844866067904402840871",
                "127246778794525201068955384976712775718",
                "268529147329843799769900686851016594608",
                "85743854775501151070841502616864243359",
                "19674381515972606272883912473096157763",
                "6881002791937441948925581587893878542",
                "133289073956155905867404914295016656774"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-27709177",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d392f7268a1a9bfbd98c831f0f4c964e59aa145",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "199344065505317176509017473485632234469",
            "length": 765.0
        },
        "target": {
            "function": "create_eml_sink",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-3a65de8e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d392f7268a1a9bfbd98c831f0f4c964e59aa145",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "326012836746042592967651703260709938403",
            "length": 579.0
        },
        "target": {
            "function": "amdgpu_dm_connector_funcs_force",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-63149853",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9671761792156f2339627918bafcd713a8a6f777",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "326012836746042592967651703260709938403",
            "length": 579.0
        },
        "target": {
            "function": "amdgpu_dm_connector_funcs_force",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-656c2855",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d392f7268a1a9bfbd98c831f0f4c964e59aa145",
        "signature_type": "Function"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "253090052355415885411640281140503081022",
                "106455795423721013992991666224143044135",
                "275856162943962597353491702935215959132",
                "249666623944525589666613696043243528182",
                "49752601887173439187998621471950559546",
                "311931868020365882993925927439492479998",
                "6881002791937441948925581587893878542",
                "133289073956155905867404914295016656774",
                "52304933088816918198312131817798671264",
                "3825653238612370571177023512628522115",
                "18628285427106232167131090995479512445",
                "330462217778438228844866067904402840871",
                "127246778794525201068955384976712775718",
                "268529147329843799769900686851016594608",
                "85743854775501151070841502616864243359",
                "19674381515972606272883912473096157763",
                "6881002791937441948925581587893878542",
                "133289073956155905867404914295016656774"
            ]
        },
        "target": {
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-734c8849",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9671761792156f2339627918bafcd713a8a6f777",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "function_hash": "199344065505317176509017473485632234469",
            "length": 765.0
        },
        "target": {
            "function": "create_eml_sink",
            "file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c"
        },
        "id": "CVE-2024-26728-fe2dca52",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9671761792156f2339627918bafcd713a8a6f777",
        "signature_type": "Function"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.7