CVE-2026-68429 - Vulnerability Details

- drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

A hotplug or link-loss event can tear down the MST topology
(setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently
with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check
is already performed under mgr->lock, the condition is not a programming
error but a valid race -- the topology was valid when the caller decided
to call this function, but was torn down before the lock was acquired.

Replace the drm_WARN_ON() with a graceful early return. This eliminates
spurious kernel warnings and the resulting compositor crashes observed
when connecting/disconnecting DP MST monitors, while keeping the correct
behavior of doing nothing when MST is not active. A drm_dbg_mst() trace
is added so the skipped probe remains observable under MST debug logging.

The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst()
already catches the case where the topology is initialized twice, so no
diagnostic coverage is lost.

Published: 2026-08-12

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race exists in the Linux kernel where a hotplug or link‑loss event tears down the Multi‑Stream Transport topology while a probing function is concurrently invoked. The function checks under a lock, but the topology can be dismantled before the lock is acquired, leading to spurious kernel warnings and compositor crashes when DP MST monitors are attached or removed.

Affected Systems

Any Linux kernel that supports DisplayPort Multi‑Stream Transport is potentially affected. No specific kernel version is restricted, so older kernels lacking the fix and newer upstream kernels without the patch may both run at risk as long as DP MST support is enabled.

Risk and Exploitability

The EPSS score is <1 %, indicating a low likelihood that this race will be actively exploited. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The CVSS score of 5.5 reflects a moderate severity. As before, the vulnerability does not compromise confidentiality or integrity; its impact is limited to operational instability caused by kernel warnings and compositor crashes. Exploitability requires a hotplug or link‑loss event on a system with DP MST enabled and an active compositor.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5f57a96e92c60f62da91d58ceb5e5acd40e7d594`	affected	< b1d05cc61dfa6c4bd5e67855bec6a03e955f512d
`dbaeef363ea54f4c18112874b77503c72ba60fec`	affected	< 4ed6d08c4a59ee6a8cb806347f6d9873de5d229e
`dbaeef363ea54f4c18112874b77503c72ba60fec`	affected	< 8c6d84a54823cd839e6ce22af559925f1320c310
`dbaeef363ea54f4c18112874b77503c72ba60fec`	affected	< afdff9103818656627920c21822e48a6dae2906f
`dbaeef363ea54f4c18112874b77503c72ba60fec`	affected	< 613059875958e7b217b250ed14c3b189f9488421
`6.6.86`	affected	< 6.6.148

Linux

affected

Version	Status	Constraints
`6.12`	affected	—
`0`	unaffected	< 6.12
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5f57a96e92c60f62da91d58ceb5e5acd40e7d594,b1d05cc61dfa6c4bd5e67855bec6a03e955f512d)`	affected	code_commit	—
`[dbaeef363ea54f4c18112874b77503c72ba60fec,4ed6d08c4a59ee6a8cb806347f6d9873de5d229e)`	affected	code_commit	—
`[dbaeef363ea54f4c18112874b77503c72ba60fec,8c6d84a54823cd839e6ce22af559925f1320c310)`	affected	code_commit	—
`[dbaeef363ea54f4c18112874b77503c72ba60fec,afdff9103818656627920c21822e48a6dae2906f)`	affected	code_commit	—
`[dbaeef363ea54f4c18112874b77503c72ba60fec,613059875958e7b217b250ed14c3b189f9488421)`	affected	code_commit	—
`[6.6.86,6.6.148)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.12`	affected	generic	—
`[0,6.12)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Verify that an updated kernel upstream contains the DP MST race‑condition fix by reviewing recent commit logs or release notes.
Apply the kernel update or patch when it becomes available and reboot to load the corrected code.
If immediate patching is not possible, disable DP MST support in kernel configuration or via boot parameters to avoid compositor crashes until the fix is applied.

Generated by OpenCVE AI on August 13, 2026 at 17:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4ed6d08c4a59ee6a8cb806347f6d9873de5d229e
https://git.kernel.org/stable/c/613059875958e7b217b250ed14c3b189f9488421
https://git.kernel.org/stable/c/8c6d84a54823cd839e6ce22af559925f1320c310
https://git.kernel.org/stable/c/afdff9103818656627920c21822e48a6dae2906f
https://git.kernel.org/stable/c/b1d05cc61dfa6c4bd5e67855bec6a03e955f512d
https://lore.kernel.org/linux-cve-announce/2026081251-CVE-2026-68429-d0b9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68429
https://www.cve.org/CVERecord?id=CVE-2026-68429

History

Thu, 13 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Thu, 13 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026081251-CVE-2026-68429-d0b9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68429 https://www.cve.org/CVERecord?id=CVE-2026-68429
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 12 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.
Title		drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4ed6d08c4a59ee6a8cb806347f6d9873de5d229e https://git.kernel.org/stable/c/613059875958e7b217b250ed14c3b189f9488421 https://git.kernel.org/stable/c/8c6d84a54823cd839e6ce22af559925f1320c310 https://git.kernel.org/stable/c/afdff9103818656627920c21822e48a6dae2906f https://git.kernel.org/stable/c/b1d05cc61dfa6c4bd5e67855bec6a03e955f512d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-12T00:07:14.640Z

Updated: 2026-08-17T05:05:25.387Z

Reserved: 2026-07-30T09:28:09.393Z

Link: CVE-2026-68429

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-12T00:17:42.940

Modified: 2026-08-17T06:17:51.940

Link: CVE-2026-68429

Redhat

Severity : Low

Publid Date: 2026-08-12T00:00:00Z

Links: CVE-2026-68429 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T18:00:04Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object