Cloudanix VulnDB

CVE-2026-90363

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux graphics driver bug can crash the whole system if display hardware setup runs into an error partway through startup.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double teardown of KMS state on partial mdp4_kms_init or mdp5_kms_init failure allows msm_drm_uninit to invoke msm_drm_kms_uninit on an already-freed object, producing a use-after-free.

Why it matters to the business

Kernel crashes during display subsystem initialization on MDP4/MDP5 hardware can prevent graphics bring-up, cause boot failures, or trigger repeated panics in Linux systems using the MSM DRM driver.

How an attack unfolds

An attacker induces a failure partway through KMS initialization (for example via panel probe or DSI attachment) so that the driver-specific destroy path runs, after which the common msm_drm_init error path executes a second teardown and triggers the use-after-free.

How to fix it

Apply the upstream fix that removes local error-path cleanup from mdp4_kms_init and mdp5_kms_init so the common msm_drm_uninit path owns teardown exclusively.

How to confirm the fix worked

Confirm the patch by inspecting drivers/gpu/drm/msm/mdp/mdp4/mdp4_kms.c and mdp5_kms.c to ensure destroy functions are no longer invoked on init failure paths.

Typical attack path

  1. Cause mdp4_kms_init or mdp5_kms_init to fail after partial allocation
  2. Return error from priv->kms_init allowing msm_drm_init to call msm_drm_uninit
  3. msm_drm_kms_uninit calls __flush_workqueue on already-released KMS object
  4. Use-after-free materializes as kernel panic or memory corruption

How to detect it

Search kernel logs and crash dumps for the call chain msm_drm_init -> msm_drm_uninit -> msm_drm_kms_uninit -> __flush_workqueue originating from dsi_host_attach or panel probe on MSM devices.

  • msm_drm_kms_uninit
  • __flush_workqueue from msm_drm_kms_uninit
  • touch_wq_lockdep_map from __flush_workqueue
  • msm_drm_uninit from msm_drm_init

What your security team should do

  • Prioritize kernel updates containing the referenced Patchwork change once released
  • Monitor kernel logs for oops traces containing msm_drm_kms_uninit and __flush_workqueue
  • Test display bring-up on MDP4/MDP5 hardware after applying the fix

The record

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't tear down KMS twice when KMS init fails When priv->kms_init() (mdp4_kms_init() / mdp5_kms_init()) fails partway through, both display drivers already tear their KMS state down via mdp4_destroy() / mdp5_kms_destroy() before returning the error. The common error path in msm_drm_init() then runs msm_drm_uninit() -> msm_drm_kms_uninit(), which tries to destroy the very same KMS a second time, which causes a use-after-free crash. Bring MDP4/MDP5 in line with the DPU driver whose dpu_kms_init() doesn't perform error cleanup on the failure. Let the common path own the cleanup, instead of freeing the KMS from their error paths. The crash trace for the reference: __lock_acquire from lock_acquire (kernel/locking/lockdep.c:5906 kernel/locking/lockdep.c:5863) lock_acquire from touch_wq_lockdep_map (kernel/workqueue.c:4094 (discriminator 1)) touch_wq_lockdep_map from __flush_workqueue (kernel/workqueue.c:4136) __flush_workqueue from msm_drm_kms_uninit (drivers/gpu/drm/msm/msm_kms.c:243 (discriminator 33)) msm_drm_kms_uninit from msm_drm_uninit (drivers/gpu/drm/msm/msm_drv.c:93) msm_drm_uninit from msm_drm_init (drivers/gpu/drm/msm/msm_drv.c:184) msm_drm_init from try_to_bring_up_aggregate_device (drivers/base/component.c:249 drivers/base/component.c:227) try_to_bring_up_aggregate_device from __component_add (drivers/base/component.c:269 drivers/base/component.c:748) __component_add from dsi_host_attach (drivers/gpu/drm/msm/dsi/dsi_host.c:1739) dsi_host_attach from mipi_dsi_attach (drivers/gpu/drm/drm_mipi_dsi.c:383) mipi_dsi_attach from sharp_nt_panel_probe (drivers/gpu/drm/panel/panel-sharp-ls043t1le01.c:247) Patchwork: https://patchwork.freedesktop.org/patch/742068/

Affected packages

Ecosystem Package Introduced Fixed