CVE-2026-45956 Linux CVE debrief

Who should care

Organizations running Linux on Exynos-based devices with VIDI (Virtual Display) output support, particularly embedded systems, mobile devices, and development boards using Samsung Exynos SoCs. System administrators of multi-user Linux systems where local attackers could attempt privilege escalation through the DRM subsystem.

Technical summary

The vidi_connection_ioctl() function in drivers/gpu/drm/exynos/exynos_drm_vidi.c incorrectly uses drm_dev->dev->driver_data to obtain a struct vidi_context pointer. However, drm_dev->dev refers to the exynos-drm master platform device, not the VIDI component device. The driver_data field in the master device contains a struct exynos_drm_private pointer, not a struct vidi_context pointer. This type confusion can result in accessing invalid memory when the code treats the exynos_drm_private structure as a vidi_context structure. The vulnerability manifests as null pointer dereferences, garbage value reads, or in severe cases, out-of-bounds access and use-after-free conditions. The resolution stores the actual VIDI device pointer in exynos_drm_private->vidi_dev during component bind/unbind, then retrieves this stored pointer in the ioctl handler to obtain the correct context.

Defensive priority

medium

Recommended defensive actions

• Apply kernel updates containing the fix commits for affected stable branches
• Review systems using Exynos-based devices with VIDI display output for kernel version exposure
• Monitor for local privilege escalation attempts on multi-user Exynos systems
• Validate that exynos_drm_private->vidi_dev is properly initialized in custom kernel builds

Evidence notes

The vulnerability description indicates this is a type confusion bug where vidi_connection_ioctl() retrieves driver_data from drm_dev->dev (the exynos-drm master device) instead of the actual VIDI component device. The driver_data in the master device contains a different structure entirely, leading to incorrect pointer dereferences when cast to struct vidi_context. The fix involves storing the vidi device pointer in exynos_drm_private->vidi_dev during bind/unbind operations and reading from this location in the ioctl handler. Multiple stable kernel branches received patches as indicated by seven distinct git.kernel.org stable commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.