CVE-2022-49483 drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit

In the Linux kernel, the following vulnerability has been resolved: drm/msm/disp/dpu1: avoid clearing hw interrupts if hwintr is null during drm uninit If edp modeset init is failed due to panel being not ready and probe defers during drm bind, avoid clearing irqs and dereference hwintr when hwin...

CVE-2022-49467

CVE-2022-49467 is a Linux kernel issue: a memory‑leak in the DRM MSM driver during mdp5_crtc_cursor_set() caused by incorrect handling in drm_gem_object_lookup/drm_gem_object_get and cursor_bo when msm_gem_get_and_pin_iova fails. Affected components/impact are within the kernel’s DRM subsystem (d...

CVE-2022-49467

In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5crtccursorset drmgemobjectlookup will call drmgemobjectget inside. So cursorbo needs to be put when msmgemgetandpiniova fails...

CVE-2022-49467 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5crtccursorset drmgemobjectlookup will call drmgemobjectget inside. So cursorbo needs to be put when msmgemgetandpiniova fails...

CVE-2022-49467 drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

In the Linux kernel, the following vulnerability has been resolved: drm: msm: fix possible memory leak in mdp5crtccursorset drmgemobjectlookup will call drmgemobjectget inside. So cursorbo needs to be put when msmgemgetandpiniova fails...

CVE-2022-49462

The CVE-2022-49462 issue affects the Linux kernel DRM MSM A6xx driver (a6xx_gpu_init). Root cause: of_parse_phandle() returns a node pointer with refcount incremented and a missing of_node_put() leads to a refcount leak. The code path in a6xx_gmu_init() passes the node to of_find_device_by_node()...

CVE-2022-49458

CVE-2022-49458 concerns the Linux kernel MSM DRM path where, if an error occurs before a request_irq() call, msm_drm_uninit() could call free_irq() on an IRQ that was not requested. The described backtrace shows a “Trying to free already-free IRQ” in a Qualcomm SM8350 environment, indicating a us...

CVE-2022-49458

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't free the IRQ if it was not requested As msmdrmuninit is called from the msmdrminit error path, additional care should be necessary as not to call the freeirq for the IRQ that was not requested before because an err...

CVE-2022-49458 drm/msm: don't free the IRQ if it was not requested

In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't free the IRQ if it was not requested As msmdrmuninit is called from the msmdrminit error path, additional care should be necessary as not to call the freeirq for the IRQ that was not requested before because an err...

CVE-2022-49336 drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem

In the Linux kernel, the following vulnerability has been resolved: drm/etnaviv: check for reaped mapping in etnaviviommuunmapgem When the mapping is already reaped the unmap must be a no-op, as we would otherwise try to remove the mapping twice, corrupting the involved data structures...

CVE-2022-49336 drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem

In the Linux kernel, the following vulnerability has been resolved: drm/etnaviv: check for reaped mapping in etnaviviommuunmapgem When the mapping is already reaped the unmap must be a no-op, as we would otherwise try to remove the mapping twice, corrupting the involved data structures...

CVE-2022-49336

The CVE-2022-49336 entry documents a Linux kernel issue in drm/etnaviv where etnaviv_iommu_unmap_gem could unmap a mapping twice if it had already been reaped. The root cause is not checking for a reaped mapping before unmapping, which could corrupt involved data structures; the vulnerability lea...

CVE-2022-49336

In the Linux kernel, the following vulnerability has been resolved: drm/etnaviv: check for reaped mapping in etnaviviommuunmapgem When the mapping is already reaped the unmap must be a no-op, as we would otherwise try to remove the mapping twice, corrupting the involved data structures...

CVE-2021-47659

In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for formatcount earlier While the check for formatcount 64 in drmuniversalplaneinit shouldn't be hit it's a WARNON, in its current position it will then leak the plane-formattypes array and fail to cal...

CVE-2021-47658

CVE-2021-47658 affects the Linux kernel DRM/AMD/PM component. The issue is a memory leak where gpu_metrics_table is allocated in renoir_init_smc_tables() but not freed in smu_v12_0_fini_smc_tables(), as described in the provided entries. Impact details are limited to a potential memory leak with ...

CVE-2022-49233

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Call dcstreamrelease for remove link enc assignment Why A porting error resulted in the stream assignment for the link being retained without being released - a memory leak. How Fix the porting error by adding ba...

CVE-2022-49233 drm/amd/display: Call dc_stream_release for remove link enc assignment

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Call dcstreamrelease for remove link enc assignment Why A porting error resulted in the stream assignment for the link being retained without being released - a memory leak. How Fix the porting error by adding ba...

CVE-2022-49232 drm/amd/display: Fix a NULL pointer dereference in amdgpu_dm_connector_add_common_modes()

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a NULL pointer dereference in amdgpudmconnectoraddcommonmodes In amdgpudmconnectoraddcommonmodes, amdgpudmcreatecommonmode is assigned to mode and is passed to drmmodeprobedadd directly after that...

CVE-2022-49222 drm/bridge: anx7625: Fix overflow issue on reading EDID

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: anx7625: Fix overflow issue on reading EDID The length of EDID block can be longer than 256 bytes, so we should use int instead of u8 for the edidpos variable...

CVE-2022-49221 drm/msm/dp: populate connector of struct dp_panel

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: populate connector of struct dppanel DP CTS test case 4.2.2.6 has valid edid with bad checksum on purpose and expect DP source return correct checksum. During drm edid read, correct edid checksum is calculated and...