CVE-2024-39498

What it actually does

NULL pointer dereference in drm_dp_add_payload_part2 due to regression that overwrote a prior NULL check, allowing invalid state access during MST payload allocation in the Linux kernel DRM subsystem.

Why it matters to the business

Kernel crashes or denial of service on Linux systems handling multi-stream display configurations, potentially disrupting graphics workloads and requiring system restarts until patched.

How an attack unfolds

An attacker with local access or control over display hardware triggers the refactored payload path in drm_dp_add_payload_part2, hitting the missing NULL guard and causing dereference; threat actor references to Android kernel RCE do not apply here as this is a local display driver flaw.

How to fix it

Update the Linux kernel to the commit fixing the regression (8e21de5f99b2368a5155037ce0aae8aaba3f5241) or later stable releases that restore the original NULL handling and remove the unnecessary state parameter.

How to confirm the fix worked

Confirm kernel source contains the fix commit, test MST display attach/detach operations under load, and verify no NULL dereference occurs in drm_dp_add_payload_part2 during payload management.

Typical attack path

1. Obtain local execution or hardware trigger on affected Linux kernel
2. Exercise MST display topology changes or payload allocation
3. Invoke drm_dp_add_payload_part2 with invalid state from prior refactor
4. Trigger NULL dereference leading to kernel oops or panic

How to detect it

Review kernel logs for oops or panic traces referencing drm_dp_add_payload_part2 or drm/mst payload functions; check for recent MST topology changes preceding crashes.

What your security team should do

• Prioritize kernel upgrade on systems using DisplayPort MST hardware
• Monitor for display-related kernel panics as immediate indicator of exposure
• Apply the specific fixed commit 8e21de5f99b2368a5155037ce0aae8aaba3f5241 in custom builds