CVE-2024-44955

What it actually does

Use-after-free via null pointer dereference in the AMD display driver when dc_sink is accessed after early release in MST hub monitor unplug scenarios; the check for dsc_aux prevents the dereference but the prior reference path was not covered.

Why it matters to the business

Kernel crashes or system instability on Linux systems using AMD GPUs with multi-monitor MST hub configurations, causing unplanned downtime and potential data loss during display reconfiguration.

How an attack unfolds

An attacker with physical access to the system unplugs a monitor connected through an MST hub; this triggers early_unregister or detect_ctx which releases dc_sink, and a subsequent display state commit dereferences the freed pointer leading to a crash.

How to fix it

Upgrade the Linux kernel to version 6.10.6-1 or later on affected Debian 13 systems; apply the patch that removes the redundant dc_sink check and ensures dsc_aux is reset to NULL on disconnect.

How to confirm the fix worked

Verify the running kernel version is at least 6.10.6-1, confirm the fix commit is present in the drm/amd/display source, and test monitor unplug/replug cycles on MST hubs without triggering null dereference.

Typical attack path

1. Connect multiple monitors via an MST hub to an AMD GPU on a Linux system
2. Trigger monitor unplug or hot-unplug event on one display
3. Kernel performs state commit that references released dc_sink object
4. Null pointer dereference occurs resulting in kernel panic or oops

How to detect it

Review kernel logs for null pointer dereference oops mentioning dc_sink, is_dsc_need_re_compute, or dsc_aux in the AMD display stack following monitor disconnect events; correlate with display reconfiguration timestamps.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems using MST hubs within the next maintenance window
• Monitor for kernel oops or panic logs related to amd_display or dsc_aux after any display changes
• Disable DSC or limit MST hub usage temporarily if immediate patching is not feasible