Към съдържанието
Търсене

CVE-2026-31488: Linux, грешка в паметта

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not skip unrelated mode changes in DSC validation Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check"), amdgpu resets the CRTC state mode_changed flag to false when recomputing the DSC configuration results in no timing change for a particular stream. However, this is incorrect in scenarios where a change in MST/DSC configuration happens in the same KMS commit as another (unrelated) mode change. For example, the integrated panel of a laptop may be configured differently (e.g., HDR enabled/disabled) depending on whether external screens are attached. In this case, plugging in external DP-MST screens may result in the mode_changed flag being dropped incorrectly for the integrated panel if its DSC configuration did not change during precomputation in pre_validate_dsc(). At this point, however, dm_update_crtc_state() has already created new streams for CRTCs with DSC-independent mode changes. In turn, amdgpu_dm_commit_streams() will never release the old stream, resulting in a memory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to the new stream either, which manifests as a use-after-free when the stream gets disabled later on: BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu] Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977 Workqueue: events drm_mode_rmfb_work_fn Call Trace: <TASK> dump_stack_lvl+0x6e/0xa0 print_address_description.constprop.0+0x88/0x320 ? dc_stream_release+0x25/0x90 [amdgpu] print_report+0xfc/0x1ff ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x225/0x4e0 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_report+0xe1/0x180 ? dc_stream_release+0x25/0x90 [amdgpu] kasan_check_range+0x125/0x200 dc_stream_release+0x25/0x90 [amdgpu] dc_state_destruct+0x14d/0x5c0 [amdgpu] dc_state_release.part.0+0x4e/0x130 [amdgpu] dm_atomic_destroy_state+0x3f/0x70

Засегнати продукти

  • Linux Linux: 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди da1d0ed31e9802fd99384f43cc63678a5a11cb41; 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди 21159d8b335a6b9f44cbb506733013a902ae2da4; 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди 10862e344b4d6434642a48c87d765813fc0b0ba7; 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди 8a5edc97fd9c6415ff2eff872748439a97e3c3d8; 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди 111208b5b7ebcdadb3f922cc52d8425f0fa91b33; 17ce8a6907f77b7ac97ddaa071d8a1f6e06ce85b преди aed3d041ab061ec8a64f50a3edda0f4db7280025
  • Linux Linux: 5.18; преди 5.18; 6.1.175 до 6.1.*; 6.6.140 до 6.6.*; 6.12.80 до 6.12.*; 6.18.21 до 6.18.*; 6.19.11 до 6.19.*; от 7.0 нататък
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: всички версии
  • Red Hat: още 11 продукта, добавени от Red Hat

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7

Вид слабост

История

  • 22 април 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-31488: Linux, грешка в паметта | freedomonline.bg