CVE-2022-48749

What it actually does

Use of ctx input parameter before the sanity check in dpu_setup_dspp_pcc leads to possible NULL pointer dereference when initializing the base variable.

Why it matters to the business

Kernel instability or crashes on affected Linux systems can cause system downtime and require reboots, especially on hardware using MSM display hardware.

How an attack unfolds

An attacker with local access crafts input that reaches dpu_setup_dspp_pcc with a NULL ctx; the missing check allows dereference before validation, potentially leading to denial of service.

How to fix it

Apply the upstream fix by updating to commit 93a6e920d8ccb4df846c03b6e72f7e08843d294c or later stable kernel versions containing the corrected parameter check ordering.

How to confirm the fix worked

Confirm the source contains the check on ctx prior to any use of the variable; review dpu_setup_dspp_pcc for the reordered initialization of base after the sanity check.

Typical attack path

1. Obtain local access on affected Linux kernel
2. Trigger display pipeline operations that invoke dpu_setup_dspp_pcc
3. Supply invalid ctx parameter to bypass intended sanity check
4. Cause NULL dereference and kernel fault

How to detect it

Inspect kernel logs for NULL pointer dereference faults originating from drm/msm/dpu code paths and audit calls to dpu_setup_dspp_pcc for unexpected parameter values.

What your security team should do

• Prioritize patching kernels on systems using MSM/DPU display drivers
• Monitor for kernel oops or panic logs referencing dpu_setup_dspp_pcc
• Apply the referenced commit across all maintained stable branches