CVE-2024-35950

What it actually does

The modes[] array in drm/client holds pointers to connector mode list entries that are protected only by dev->mode_config.mutex; without extending the same lock to modes[] the pointers can become dangling after concurrent mode list modifications free or reuse the objects.

Why it matters to the business

Unpatched kernels may experience graphics subsystem instability or denial-of-service crashes when display configuration changes occur under concurrent access, increasing operational risk for systems relying on the Linux DRM stack.

How an attack unfolds

A local attacker triggers a race by performing display mode operations on one thread while another thread iterates the unprotected modes[] array, causing use-after-free dereferences that manifest as kernel crashes or memory corruption.

How to fix it

Apply the upstream fix present in commit 5a2f957e3c4553bbb100504a1acfeaeb33f4ca4e or later; rebuild and deploy updated kernel packages containing this commit across all affected distributions.

How to confirm the fix worked

Verify the running kernel git revision contains commit 5a2f957e3c4553bbb100504a1acfeaeb33f4ca4e or confirm the source tree no longer contains the original unlocked modes[] access pattern.

Typical attack path

1. Obtain local user privileges on an affected Linux system
2. Open multiple threads or processes that manipulate DRM connectors and modes concurrently
3. Trigger mode list updates while the client code walks the unprotected modes[] array
4. Cause the kernel to dereference freed or reused mode objects leading to crash or corruption

How to detect it

Inspect kernel logs for drm-related oops or use-after-free warnings during display configuration changes; correlate with processes performing concurrent mode setting operations.

What your security team should do

• Prioritize kernel updates containing commit 5a2f957e3c4553bbb100504a1acfeaeb33f4ca4e on all production systems
• Monitor upstream stable branches for backports and schedule rolling restarts
• Review graphics and display workloads for high-concurrency mode changes as a temporary risk reduction step