CVE-2024-43894

What it actually does

Null pointer dereference in drm_client_modeset_probe when drm_mode_duplicate fails, allowing modeset->mode to remain NULL and subsequent dereference to crash the kernel.

Why it matters to the business

Unexpected system crashes or instability during graphics initialization on Linux systems, leading to downtime and potential data loss in environments relying on the DRM subsystem.

How an attack unfolds

An attacker with local access or the ability to influence display modeset operations triggers the failure path in drm_mode_duplicate, causing the kernel to dereference a null pointer and panic. No widespread in-the-wild exploitation is documented despite mentions of general Linux kernel campaigns.

How to fix it

Update the Linux kernel to a version containing commit 24ddda932c43ffe156c7f3c568bed85131c63ae6 or later; apply the fix that adds a NULL check after drm_mode_duplicate.

How to confirm the fix worked

Verify the presence of the NULL check after drm_mode_duplicate in drm_client_modeset_probe; confirm kernel version includes the referenced commit or backport.

Typical attack path

1. Obtain local access or trigger display configuration changes
2. Force drm_mode_duplicate to fail during client modeset probe
3. Trigger null dereference on modeset->mode access
4. Cause kernel panic or denial of service

How to detect it

Review kernel logs for null pointer dereference oops in drm_client_modeset_probe; search system logs and crash dumps for stack traces involving DRM modeset functions.

• drm_client_modeset_probe
• drm_mode_duplicate
• modeset->mode

What your security team should do

• Prioritize kernel updates on all affected Linux systems
• Monitor for kernel oops or panic reports related to DRM client modeset
• Test graphics initialization paths in staging environments after patching