Rodrigo Siqueira

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a double free problem in the Linux kernel's amdgpu module. Specifically, the `link destruct()` function in the `drivers/gpu/drm/amd/display/dc/link/link factory.c` file is vulnerable to repeated freeing of previously freed memory. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability occurs when unloading the amdgpu module, and it involves the `dcn10 link encoder destroy()` and `link destroy()` functions. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.5.0-41-generic #41~22.04.2-Ubuntu **Description** The issue is related to a null pointer dereference in the `dcn20 resource.c` file of the Linux kernel's `drm/amd/display` module. This vulnerability can cause a hang when running MPV on a DCN401 dGPU with specific settings, such as `mpv --hwdec=vaapi --vo=gpu --hwdec-codecs=all`, and then enabling fullscreen playback. The call trace shows a kernel NULL pointer dereference at address 0000000000000000. **Recommendations** To resolve this issue, update the Linux kernel to a version newer than 6.5.0-41-generic #41~22.04.2-Ubuntu. As a temporary workaround, consider avoiding the use of MPV with the specified settings on affected systems until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A NULL pointer dereference vulnerability has been resolved in the Linux kernel, specifically in the drm/amd/display component. The issue occurs when the color log tries to read the gamut remap information from DCN401, which is not initialized in the dcn401 dpp funcs, leading to a null pointer dereference. This vulnerability is addressed by adding a proper guard to access the gamut remap callback in case the specific ASIC did not implement this function. The vulnerability can be triggered by running the command `cat /sys/kernel/debug/dri/0/amdgpu dm dtn log`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 6.6.37 **Description** A dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as the writeback connector does not support certain features which are not initialized. The issue occurs in the drm/amd/display component when it attempts to write back data. To resolve this, the connector type is checked, and if it is DRM MODE CONNECTOR WRITEBACK, the operation is skipped. **Recommendations** Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider disabling the writeback feature for the drm/amd/display component until a patch is available.