CVE-2022-3115

What it actually does

Null pointer dereference in malidp_crtc_reset due to unchecked kzalloc return value in the ARM Mali DRM driver, resulting in kernel crash on dereference.

Why it matters to the business

Local denial of service on Linux systems using affected ARM display hardware, leading to unplanned reboots or service disruption; low prevalence reduces widespread risk but still requires attention for kernel stability.

How an attack unfolds

An attacker with local access triggers the malidp_crtc_reset path under memory pressure so kzalloc fails, then the subsequent write to the unchecked null pointer causes an oops or panic. No remote vector or privilege escalation is present.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the missing kzalloc check in drivers/gpu/drm/arm/malidp_crtc.c; apply the upstream patch if backporting is required. No fixed versions were listed in the source data.

How to confirm the fix worked

Inspect the malidp_crtc_reset function for an explicit NULL check after kzalloc; attempt to reproduce under memory pressure and confirm absence of NULL dereference oops.

Typical attack path

1. Obtain local shell or process execution on target system
2. Trigger DRM crtc reset operations involving the malidp driver
3. Induce kzalloc failure via memory exhaustion
4. Trigger null pointer dereference and kernel crash

How to detect it

Search kernel logs for oops/panic entries referencing malidp_crtc_reset or null pointer dereference in drivers/gpu/drm/arm/; correlate with local user activity preceding the crash.

• malidp_crtc_reset
• drivers/gpu/drm/arm/malidp_crtc.c
• NULL pointer dereference in malidp

What your security team should do

• Prioritize kernel updates on systems exposing the malidp DRM driver
• Restrict unprivileged local access where feasible until patched
• Monitor EPSS trend and kernel mailing lists for exploit maturity changes