CVE-2024-53056

What it actually does

NULL pointer dereference in mtk_crtc_destroy() when mbox_request_channel() fails in mtk_crtc_create(), leaving cmdq_client.chan as NULL without a prior cmdq_pkt_create() call, causing cmdq_pkt_destroy() to dereference NULL during cleanup.

Why it matters to the business

Kernel crashes or denial of service on systems using MediaTek display hardware can interrupt graphics, video, or embedded device operations and require reboots or recovery.

How an attack unfolds

An attacker triggers the failure path for mailbox channel acquisition in the DRM Mediatek driver initialization, then forces cleanup code to invoke cmdq_pkt_destroy() on the unset pointer, resulting in a kernel NULL dereference.

How to fix it

Update the Linux kernel to commit c60583a87cb4a85b69d1f448f0be5eb6ec62cbb2 or later stable releases containing the NULL check before cmdq_pkt_destroy().

How to confirm the fix worked

Verify the presence of the added NULL check on mtk_crtc->cmdq_client.chan prior to cmdq_pkt_destroy() in mtk_crtc_destroy() and confirm the kernel version includes the fix commit.

Typical attack path

1. Trigger mtk_crtc_create() under conditions causing mbox_request_channel() to fail
2. Ensure cmdq_client.chan is set to NULL without calling cmdq_pkt_create()
3. Invoke mtk_crtc_destroy() or equivalent cleanup path
4. cmdq_pkt_destroy() dereferences the NULL chan pointer causing kernel fault

How to detect it

Search kernel logs for NULL pointer dereference oops containing mtk_crtc_destroy, cmdq_pkt_destroy, or mtk_crtc_create stack traces; review dmesg or syslog around device initialization or DRM probe failures.

• mtk_crtc_destroy
• cmdq_pkt_destroy
• mtk_crtc->cmdq_client.chan
• NULL pointer dereference in drm/mediatek

What your security team should do

• Apply the kernel patch or upgrade to a fixed version immediately on all affected MediaTek DRM systems
• Monitor for kernel oops/panic reports involving mtk_crtc_destroy and cmdq_pkt_destroy
• Restrict unprivileged access to display or DRM interfaces where feasible until patched