CVE-2024-26661

What it actually does

NULL pointer dereference in dcn21_set_pipe when pipe_ctx->stream_res.tg is NULL before accessing tg->inst, causing kernel memory corruption or panic in AMD display code paths.

Why it matters to the business

Kernel crashes or instability on affected Linux systems using AMD GPUs, leading to downtime, potential privilege escalation in container or display workloads, and requiring urgent patching on widely deployed kernel versions.

How an attack unfolds

An attacker with local access or control over display pipe setup supplies a pipe context lacking a timing generator, triggering the unguarded dereference during dcn21_set_pipe execution and resulting in memory corruption that can be leveraged for escalation.

How to fix it

Update the Linux kernel to the fixed commit 3f3c237a706580326d3b7a1b97697e5031ca4667 or later stable releases containing the NULL check addition in dcn21_set_pipe.

How to confirm the fix worked

Verify kernel source contains the added NULL test for stream_res.tg before the inst access, or confirm running kernel version incorporates commit 3f3c237a706580326d3b7a1b97697e5031ca4667 via git log or uname.

Typical attack path

1. Obtain local execution or container access on a vulnerable AMD Linux system
2. Craft or trigger display pipe configuration that leaves stream_res.tg as NULL
3. Invoke dcn21_set_pipe to reach the unguarded tg->inst access
4. Exploit resulting kernel memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for NULL pointer dereference oops in drm/amd/display or dcn21_set_pipe; inspect for unexpected display pipe configuration attempts preceding crashes.

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all AMD GPU systems
• Monitor for display-related kernel oops or panics in logs as interim indicators
• Restrict unprivileged access to display or DRM interfaces where feasible until patched