{"id":25772,"date":"2026-09-18T04:31:52","date_gmt":"2026-09-17T20:31:52","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90363"},"modified":"2026-09-18T04:31:52","modified_gmt":"2026-09-17T20:31:52","slug":"cve-2026-90363","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90363","title":{"rendered":"CVE-2026-90363 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\ndrm\/msm: don&#8217;t tear d"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/msm: don&#8217;t tear down KMS twice when KMS init fails<\/p>\n<p>When priv-&gt;kms_init() (mdp4_kms_init() \/ mdp5_kms_init()) fails partway<br \/>\nthrough, both display drivers already tear their KMS state down via<br \/>\nmdp4_destroy() \/ mdp5_kms_destroy() before returning the error. The<br \/>\ncommon error path in msm_drm_init() then runs msm_drm_uninit() -&gt;<br \/>\nmsm_drm_kms_uninit(), which tries to destroy the very same KMS a second<br \/>\ntime, which causes a use-after-free crash.<\/p>\n<p>Bring MDP4\/MDP5 in line with the DPU driver whose dpu_kms_init() doesn&#8217;t<br \/>\nperform error cleanup on the failure. Let the common path own the<br \/>\ncleanup, instead of freeing the KMS from their error paths.<\/p>\n<p>The crash trace for the reference:<\/p>\n<p>  __lock_acquire from lock_acquire (kernel\/locking\/lockdep.c:5906 kernel\/locking\/lockdep.c:5863)<br \/>\n  lock_acquire from touch_wq_lockdep_map (kernel\/workqueue.c:4094 (discriminator 1))<br \/>\n  touch_wq_lockdep_map from __flush_workqueue (kernel\/workqueue.c:4136)<br \/>\n  __flush_workqueue from msm_drm_kms_uninit (drivers\/gpu\/drm\/msm\/msm_kms.c:243 (discriminator 33))<br \/>\n  msm_drm_kms_uninit from msm_drm_uninit (drivers\/gpu\/drm\/msm\/msm_drv.c:93)<br \/>\n  msm_drm_uninit from msm_drm_init (drivers\/gpu\/drm\/msm\/msm_drv.c:184)<br \/>\n  msm_drm_init from try_to_bring_up_aggregate_device (drivers\/base\/component.c:249 drivers\/base\/component.c:227)<br \/>\n  try_to_bring_up_aggregate_device from __component_add (drivers\/base\/component.c:269 drivers\/base\/component.c:748)<br \/>\n  __component_add from dsi_host_attach (drivers\/gpu\/drm\/msm\/dsi\/dsi_host.c:1739)<br \/>\n  dsi_host_attach from mipi_dsi_attach (drivers\/gpu\/drm\/drm_mipi_dsi.c:383)<br \/>\n  mipi_dsi_attach from sharp_nt_panel_probe (drivers\/gpu\/drm\/panel\/panel-sharp-ls043t1le01.c:247)<\/p>\n<p>Patchwork: https:\/\/patchwork.freedesktop.org\/patch\/742068\/<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>drm\/msm: don&#8217;t tear down KMS twice when KMS init fails<\/p>\n<p>When priv-&gt;kms_init() (mdp4_kms_init() \/ mdp5_kms_init()) fails partway<br \/>\nthr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25772","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}