CVE-2024-46851

What it actually does

Race condition in AMD display driver allowing dc_state_destruct to null resource context pointers while dcn10_set_drr is executing from IRQ context, resulting in use of invalid stream_resource function callbacks after a NULL check.

Why it matters to the business

Linux systems using AMD GPUs may experience kernel crashes or potential local privilege escalation; high ecosystem prevalence of the kernel increases exposure for servers and workstations until patched.

How an attack unfolds

An attacker with local access triggers concurrent display state destruction and IRQ processing to win the race after the tg NULL check but before subsequent callback access, leading to invalid memory operations; listed threat actors in 2024 zero-day campaigns and Linux kernel resource issues indicate possible interest from espionage and financially motivated groups.

How to fix it

Apply kernel patches containing commit b6ce047a81f508f5c60756db8dfb5ff486e4dad0; github.com/foxcpp/maddy users should upgrade to version 0.5.2.

How to confirm the fix worked

Confirm presence of commit b6ce047a81f508f5c60756db8dfb5ff486e4dad0 in kernel source; test display operations under concurrent state destruction workloads to verify absence of race.

Typical attack path

1. Obtain local code execution on affected Linux system with AMD display hardware
2. Trigger parallel dc_state_destruct and IRQ path invoking dcn10_set_drr
3. Win timing window after NULL check but before callback use
4. Execute arbitrary operations via corrupted stream_resource fields

How to detect it

Review kernel logs for null pointer dereferences or invalid function pointer accesses in drm/amd/display paths during IRQ or display state changes; correlate with process activity attempting concurrent graphics state modifications.

What your security team should do

• Prioritize kernel updates on all AMD GPU systems within standard patch windows
• Monitor vendor advisories for backports to supported stable branches
• Restrict unprivileged local access where feasible until deployment completes