Hamza Mahfooz

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the handling of plane refcount in the Linux kernel's drm/amd/display module. The mechanism to backup and restore plane states does not maintain the refcount, which can cause problems if the refcount of the plane changes between backup and restore operations. This can lead to memory leaks if the refcount was supposed to go down, or double frees/invalid memory accesses if the refcount was supposed to go up. The fix involves caching and re-applying the current refcount when restoring plane states. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel versions prior to 6.11.9 **Description** The issue is related to the `dc state copy internal` function in the Linux kernel's `drm/amd/display` module. It concerns a double free vulnerability that occurs when a `dml` allocation fails, causing subsequent calls to `dc state copy internal` to shallow copy invalid memory. If the new state is released, a double free would occur, potentially allowing an attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Linux Kernel versions prior to 6.11.9, update to a version that includes the fix for the `dml` allocation failure issue, such as version 6.11.10 or later, to prevent double free crashes. As a temporary workaround, consider applying the patch from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c to reset `dml` pointers in `new state` to NULL and avoid invalid pointers.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference vulnerability has been resolved in the Linux kernel, specifically in the drm/amd/display component. The issue occurs when the color log tries to read the gamut remap information from DCN401, which is not initialized in the dcn401 dpp funcs, leading to a null pointer dereference. This vulnerability is addressed by adding a proper guard to access the gamut remap callback in case the specific ASIC did not implement this function. The vulnerability can be triggered by running the command `cat /sys/kernel/debug/dri/0/amdgpu dm dtn log`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.