CVE-2024-49897

What it actually does

NULL pointer dereference in AMD display driver when dcn32_enable_phantom_stream returns null and the result is used without validation, classified under MemoryCorruption.

Why it matters to the business

Potential system instability or crashes affecting graphics workloads on AMD hardware in Linux environments; low exploitation likelihood limits immediate operational risk despite wide kernel prevalence.

How an attack unfolds

An attacker with local access triggers the phantom stream enable path in the display code so that a null return from dcn32_enable_phantom_stream is dereferenced, causing undefined behavior; listed threat actor campaigns targeting Linux kernel flaws provide context but no public exploit exists for this specific issue.

How to fix it

Update the Linux kernel to commit db1d7e1794fed62ee16d6a72a85997bb069e2e27 or later; apply the listed fixed package versions for Rocky Linux 8 Qt5 components where applicable (e.g., qt5 0:5.12.5-3.el8).

How to confirm the fix worked

Verify kernel source contains the phantom_stream null check, confirm package versions match the supplied fixed releases, and run targeted display driver test suites to ensure no null dereference occurs.

Typical attack path

1. Obtain local code execution on affected Linux system
2. Trigger display configuration or mode-setting operations that invoke dcn32_enable_phantom_stream
3. Force the function to return null
4. Trigger subsequent use of the unchecked pointer leading to kernel fault

How to detect it

Review kernel logs for null pointer dereference oops messages in amd/display or dcn32 code paths; correlate with process activity involving display or graphics initialization.

What your security team should do

• Prioritize kernel updates on systems with AMD GPUs
• Monitor EPSS and threat actor activity for any increase in exploitation attempts
• Apply all listed Rocky Linux package fixes during next maintenance window