Description
In the Linux kernel, the following vulnerability has been resolved:

drm/rockchip: dw_dp: Switch to drmm_kzalloc()

Driver makes use of drmm_encoder_init() to initialize the encoder and
automatically handle the cleanup by registering drm_encoder_cleanup()
with drmm_add_action().

However, the internal structure containing the encoder part gets
allocated with devm_kzalloc(), which happens while component_bind_all()
is being called from Rockchip DRM driver. The component framework
further ensures it is deallocated as part of releasing all the resources
claimed during bind, which is triggered from component_unbind_all().

When the reference to the DRM device gets eventually dropped via
drm_dev_put() in rockchip_drm_unbind(), drmm_encoder_alloc_release()
attempts to access the now released encoder structure, leading to
use-after-free.

Ensure driver's internal structure is still reachable on encoder cleanup
by switching from a device-managed allocation to a drm-managed one.
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Rockchip DRM driver in the Linux kernel allocates an internal structure with devm_kzalloc during component binding. When the component is unbound, this structure is freed as part of the component framework cleanup. Subsequently, when the DRM device is released, the driver attempts to access the already freed structure, leading to a use‑after‑free and potential kernel memory corruption.

Affected Systems

All Linux systems running a kernel that includes the Rockchip DRM driver are affected; the issue is present in the dw_dp component of the driver and is in any distribution that ships this code without the pending fix.

Risk and Exploitability

The use‑after‑free could result in kernel memory corruption if the improper cleanup sequence occurs. The CVSS 5.5, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. No public exploits are known, and the potential impact depends on the environment and the occurrence of the cleanup sequence.

Generated by OpenCVE AI on August 21, 2026 at 22:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a Linux kernel version that incorporates the change to use drmm_kzalloc for the affected structure
  • If an immediate kernel upgrade is not feasible, disable the Rockchip DRM driver or unload it to prevent the unbind sequence from executing
  • Verify that any custom kernel modules or build configurations do not rely on the legacy device‑managed allocation used by this driver

Generated by OpenCVE AI on August 21, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 15 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 15 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw_dp: Switch to drmm_kzalloc() Driver makes use of drmm_encoder_init() to initialize the encoder and automatically handle the cleanup by registering drm_encoder_cleanup() with drmm_add_action(). However, the internal structure containing the encoder part gets allocated with devm_kzalloc(), which happens while component_bind_all() is being called from Rockchip DRM driver. The component framework further ensures it is deallocated as part of releasing all the resources claimed during bind, which is triggered from component_unbind_all(). When the reference to the DRM device gets eventually dropped via drm_dev_put() in rockchip_drm_unbind(), drmm_encoder_alloc_release() attempts to access the now released encoder structure, leading to use-after-free. Ensure driver's internal structure is still reachable on encoder cleanup by switching from a device-managed allocation to a drm-managed one.
Title drm/rockchip: dw_dp: Switch to drmm_kzalloc()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:19:06.310Z

Reserved: 2026-08-15T05:44:03.894Z

Link: CVE-2026-74421

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:44.197

Modified: 2026-08-17T06:19:37.550

Link: CVE-2026-74421

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74421 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T22:30:17Z

Weaknesses