CVE-2021-47108

What it actually does

Missing NULL pointer check for hdmi->conf in mtk_hdmi_bridge_mode_valid allows dereference when no mtk_hdmi_conf is present (MT8173 and similar), resulting in kernel panic on HDMI cable insertion.

Why it matters to the business

Affected systems experience kernel crashes and loss of HDMI display functionality when an external display is connected, causing denial of service and potential loss of unsaved work.

How an attack unfolds

An attacker simply connects an HDMI cable to a vulnerable device; the kernel calls mtk_hdmi_bridge_mode_valid which immediately dereferences a NULL conf pointer, triggering a panic. No code execution or special privileges are required beyond physical or virtual cable attachment.

How to fix it

Apply the upstream fix that adds an explicit NULL check for hdmi->conf before accessing its members; rebuild and deploy a kernel containing commit resolution for this regression.

How to confirm the fix worked

Inspect the patched mtk_hdmi_bridge_mode_valid function for the added NULL guard; on MT8173-class hardware, connect an HDMI cable and confirm the system remains stable with no oops or panic.

Typical attack path

1. Connect HDMI cable to affected MediaTek platform
2. Kernel invokes mtk_hdmi_bridge_mode_valid without an mtk_hdmi_conf struct
3. NULL pointer dereference occurs inside the CEA-mode or clock-limit checks
4. Kernel panics, rendering the system unusable until reboot

How to detect it

Search kernel logs and crash dumps for entries containing mtk_hdmi_bridge_mode_valid, drm/mediatek hdmi NULL pointer dereference, or panic on HDMI attach; correlate with device boot or display connection timestamps.

• mtk_hdmi_bridge_mode_valid
• NULL pointer dereference.*mtk_hdmi
• drm/mediatek.*hdmi.*panic

What your security team should do

• Update to a Linux kernel that includes the NULL-pointer guard
• Add kernel oops/panic monitoring for drm/mediatek HDMI paths
• Test HDMI hot-plug behavior on all MediaTek SoC platforms before deployment