CVE-2024-49912

What it actually does

Null pointer dereference in the AMD display driver when stream_status is unexpectedly null inside planes_changed_for_existing_stream, allowing a crash via memory corruption.

Why it matters to the business

Potential system instability or denial of service on Linux systems using AMD graphics hardware, increasing operational risk and patching urgency for organizations running affected kernels.

How an attack unfolds

An attacker with local access crafts display configuration changes that reach the vulnerable code path with a null stream_status pointer, triggering a kernel crash. No widespread in-the-wild exploitation is indicated despite listed threat actor campaigns targeting similar Linux kernel issues.

How to fix it

Upgrade the Linux kernel to a version containing commit c4b699b93496c423b0e5b584d4eb4ab849313bcf. For libvorbis on Rocky Linux 8 apply the package update to 1:1.3.6-2.el8 or later.

How to confirm the fix worked

Verify the presence of the null check for stream_status in drivers/gpu/drm/amd/display/dc/core/dc_resource.c around line 3784 and confirm the running kernel includes the referenced commit hash.

Typical attack path

1. Obtain local access on a vulnerable Linux system with AMD display hardware
2. Trigger display stream or plane configuration operations that reach planes_changed_for_existing_stream
3. Supply or induce a null stream_status value
4. Cause null pointer dereference leading to kernel panic or crash

How to detect it

Review kernel logs for null pointer dereference oops in dc_resource.c or amd display paths; correlate with recent display configuration changes or graphics driver activity.

What your security team should do

• Apply the kernel update containing commit c4b699b93496c423b0e5b584d4eb4ab849313bcf as highest priority
• Monitor for kernel oops or panic reports involving AMD display code
• Restrict unprivileged local access on systems with AMD GPUs until patched