CVE-2024-46850

What it actually does

Race condition in AMD display driver where dc_state_destruct() nulls resource context while dcn35_set_drr() (called from IRQ) accesses stream_resource fields after a NULL check, leading to use of invalid function callbacks.

Why it matters to the business

Systems with AMD GPUs may experience kernel panics or display instability during normal operation or driver state changes, causing unexpected downtime and requiring reboots until patched.

How an attack unfolds

An attacker with local access triggers concurrent calls to display state destruction and IRQ-driven display refresh operations; the timing window allows access to nulled structures after the safety check, potentially crashing the system or enabling further kernel memory corruption.

How to fix it

Update the Linux kernel to a version containing commit 42850927656a540428e58d370b3c1599a617bac7 or later; apply the cherry-picked fix from 0607a50c004798a96e62c089a4c34c220179dcb5 in stable branches; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm kernel source includes the local variable copy of tg before use in dcn35_set_drr(); verify running kernel version against fixed commit hashes; test display hotplug and mode-setting operations under load to ensure no crashes occur.

Typical attack path

1. Obtain local code execution on affected Linux system with AMD display hardware
2. Trigger display state changes that invoke dc_state_destruct()
3. Simultaneously induce IRQ processing that calls dcn35_set_drr()
4. Exploit the narrow window between NULL check and subsequent access to corrupted pointers

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for null pointer dereference or oops messages referencing dcn35_set_drr or stream_resource; correlate timestamps of display state changes with IRQ events; no public exploit artifacts known.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within maintenance windows
• Monitor for related display driver oops or panic reports in dmesg
• Restrict unprivileged local access until patches are deployed if risk tolerance is low