CVE-2022-48843

What it actually does

NULL pointer dereference in the Linux kernel DRM/VRR subsystem when a driver attempts to set the VRR-capable property on a connector that does not have the property attached, resulting in a kernel crash.

Why it matters to the business

Local users on affected Linux systems can trigger kernel panics leading to denial of service, system reboots, and potential loss of availability for graphics workloads; high ecosystem prevalence in Linux kernels increases exposure across servers, desktops, and embedded devices.

How an attack unfolds

An attacker with local access crafts or triggers graphics operations that invoke the drm core set-property function on a VRR connector without the property being attached, causing the NULL dereference and kernel panic; the listed Android kernel threat actor context indicates possible interest in similar kernel flaws for local code execution chains.

How to fix it

Upgrade to a fixed kernel version such as 5.17 or the commit 62929726ef0ec72cbbe9440c5d125d4278b99894 in the stable Linux GIT repository; apply vendor-supplied kernel updates that ensure the VRR capable property is only set when attached.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release; review drm_connector.c and related VRR code paths to verify the property attachment check precedes any set-property call; test with VRR-enabled displays and drivers.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Load or interact with a DRM driver that supports VRR but does not attach the capable property by default
3. Invoke operations that call drm_object_property_set_value on the unattached VRR property
4. Trigger NULL dereference and kernel panic

How to detect it

Review kernel logs for NULL pointer dereference oops messages referencing drm/vrr or drm_connector_property_set_value; correlate with graphics driver initialization and VRR-related property calls.

What your security team should do

• Prioritize kernel updates on all Linux systems with DRM/VRR graphics support within standard patch windows
• Monitor for local privilege-escalation chains that could leverage this crash for further impact
• Restrict untrusted local access on multi-user systems until patched