CVE-2024-26667

What it actually does

Potential invalid memory access in dpu_encoder_helper_phys_cleanup due to dereferencing hw_pp without validation in the MSM DPU display driver path introduced by prior writeback changes.

Why it matters to the business

Kernel instability or crashes on Linux systems using affected display hardware during specific output operations, resulting in unplanned downtime and reduced system reliability for graphics workloads.

How an attack unfolds

An attacker with local access triggers display writeback operations involving YUV output to reach the vulnerable conditional block and cause invalid pointer dereference.

How to fix it

Update the Linux kernel to the fixed commit fb8bfc6ea3cd8c5ac3d35711d064e2f6646aec17 or apply the equivalent patch that adds hw_pp validity checks before dereference.

How to confirm the fix worked

Verify the presence of the hw_pp validity check in dpu_encoder_helper_phys_cleanup in the running kernel source or confirm the commit hash is included in the deployed kernel build.

Typical attack path

1. Obtain local access to affected Linux system
2. Configure or trigger display writeback with YUV output mode
3. Invoke dpu_encoder_helper_phys_cleanup path
4. Trigger invalid hw_pp dereference leading to memory corruption or crash

How to detect it

Review kernel logs for oops or panic messages referencing dpu_encoder_helper_phys_cleanup or msm dpu driver around display configuration changes; no specific pre-exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on systems with MSM DPU hardware
• Monitor for display-related kernel oops or panics after applying fixes
• Test display writeback functionality post-update to confirm stability