CVE-2024-26874

What it actually does

Race condition between mtk_drm_crtc_atomic_flush and mtk_drm_finish_page_flip allows mtk_crtc->event to become NULL after a pending_needs_vblank check, resulting in a null pointer dereference and kernel crash in mtk_drm_crtc_finish_page_flip.

Why it matters to the business

Systems using affected Mediatek DRM hardware may experience unexpected kernel panics and reboots during graphics operations, causing downtime and loss of availability on Linux-based devices and servers.

How an attack unfolds

An attacker with local access triggers concurrent DRM atomic operations and page-flip completion paths on Mediatek hardware; the unsynchronized write to pending_needs_vblank after the event pointer is cleared leads to the crash when the second interrupt handler runs.

How to fix it

Update the Linux kernel to a version containing commit accdac6b71d5a2b84040c3d2234f53a60edc398e which adds a NULL check for mtk_crtc->event before use in mtk_drm_crtc_finish_page_flip.

How to confirm the fix worked

Confirm the running kernel contains commit accdac6b71d5a2b84040c3d2234f53a60edc398e or later; exercise DRM page-flip paths under concurrent atomic operations and verify absence of null pointer oops in dmesg.

Typical attack path

1. Obtain local code execution on a system with Mediatek DRM driver
2. Perform rapid DRM atomic begin/flush sequences while page flips are completing
3. Trigger the window where mtk_crtc->event is nulled under one lock but checked under another
4. Cause second invocation of finish_page_flip with stale pending_needs_vblank flag
5. Dereference the now-NULL event pointer and crash the kernel

How to detect it

Review kernel logs for oops or panic messages referencing mtk_drm_crtc_finish_page_flip and null pointer dereference around DRM atomic flush operations; correlate with Mediatek display hardware usage.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all Mediatek DRM systems
• Apply the fix within standard patch windows given low EPSS and absence from KEV
• Monitor vendor kernel packages for backports of accdac6b71d5a2b84040c3d2234f53a60edc398e