Cloudanix VulnDB

CVE-2026-98605

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A coding mistake in the Linux display driver can cause the system to crash when screens are repeatedly connected or reconfigured.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Mismatched GPIO descriptor lifetime management in samsung-dsim causes a use-after-free when the DSI host attach callback re-requests the TE GPIO without a prior release on detach.

Why it matters to the business

Kernel instability or crashes on systems using Exynos or similar Samsung DSI display hardware, with potential display subsystem downtime; low immediate exploitation risk but requires prompt patching on affected kernels.

How an attack unfolds

An attacker with local access repeatedly triggers DSI host attach and detach operations (for example via display reconfiguration or driver reload) to force the driver into requesting an already-managed GPIO, leading to use-after-free conditions that may be leveraged for privilege escalation.

How to fix it

Apply the upstream fix that switches back to non-managed gpiod_get_optional() with explicit gpiod_put() calls on error and unregister paths; rebuild and deploy the corrected kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the samsung-dsim.c source for non-managed GPIO acquisition and matching explicit release calls; test attach/detach cycles under load to verify no descriptor reuse occurs.

Typical attack path

  1. Obtain local access on a system using the samsung-dsim driver
  2. Trigger repeated DSI host attach/detach cycles
  3. Cause the driver to reuse a freed GPIO descriptor
  4. Exploit the resulting use-after-free for memory corruption

How to detect it

Review kernel logs for use-after-free warnings or oops involving samsung_dsim or TE GPIO; inspect for repeated attach/detach events in drm debug logs around the time of crashes.

What your security team should do

  • Prioritize kernel update on all systems exposing Samsung DSI bridges
  • Monitor for display-related kernel oops or warnings indicating GPIO lifetime issues
  • Limit unprivileged access to display reconfiguration interfaces until patched

The record

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiod_get_optional() to devm_gpiod_get_optional() while keeping the matching gpiod_put() calls. That combination is wrong for a managed descriptor. However, dropping the puts and keeping the managed get is also wrong: samsung_dsim_register_te_irq() runs from the DSI host attach callback, and host detach/reattach can happen without destroying the device that owns the managed action. A second attach would then request the GPIO again without having released it. Switch back to a non-managed gpiod_get_optional() and keep the explicit gpiod_put() on the request_irq() error path and in samsung_dsim_unregister_te_irq(). [Luca: remove unnecessary comment]

Affected packages

Ecosystem Package Introduced Fixed