CVE-2024-57798

What it actually does

NULL pointer dereference and use-after-free of the mst_primary pointer in drm_dp_mst_handle_up_req() when concurrent topology removal via drm_dp_mst_topology_mgr_set_mst(false) frees the structure from another thread.

Why it matters to the business

System instability, crashes, or potential privilege escalation in graphics display handling on affected Linux systems, with limited immediate operational disruption given low exploitability indicators.

How an attack unfolds

An attacker with local access or influence over display topology threads triggers a race by initiating an MST up request while another thread disables MST topology, causing the handler to dereference a now-freed or NULL mst_primary pointer; listed threat actors have targeted similar kernel flaws but no confirmed campaigns for this specific issue.

How to fix it

Update affected systems to kernel versions containing the reference-counting fix for mst_primary; for listed chromium-browser packages on Ubuntu 14.04 LTS, upgrade to 58.0.3029.81-0ubuntu0.14.04.1172 or later.

How to confirm the fix worked

Confirm kernel or package versions match or exceed the fixed releases, review source for the added reference hold in drm_dp_mst_handle_up_req(), and test concurrent MST topology operations for stability.

Typical attack path

1. Gain local execution or trigger display-related operations on a vulnerable kernel
2. Initiate concurrent MST topology management calls from multiple threads
3. Force topology removal to free mst_primary while an up request is being processed
4. Trigger NULL dereference or use-after-free to crash or attempt code execution

How to detect it

Review kernel logs for NULL pointer dereferences or use-after-free warnings in drm_dp_mst paths, correlate with display topology changes, and check for activity from listed threat actors exploiting similar Linux kernel issues.

What your security team should do

• Prioritize kernel updates on systems using DisplayPort MST
• Monitor for any new exploit maturity or KEV listing given the 638 days since publication
• Apply the specific chromium-browser fixed version on Ubuntu 14.04 LTS environments