Description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Init `ddp_comp` with devm_kcalloc()
In the case where `conn_routes` is true we allocate an extra slot in
the `ddp_comp` array but mtk_drm_crtc_create() never seemed to
initialize it in the test case I ran. For me, this caused a later
crash when we looped through the array in mtk_drm_crtc_mode_valid().
This showed up for me when I booted with `slub_debug=FZPUA` which
poisons the memory initially. Without `slub_debug` I couldn't
reproduce, presumably because the later code handles the value being
NULL and in most cases (not guaranteed in all cases) the memory the
allocator returned started out as 0.
It really doesn't hurt to initialize the array with devm_kcalloc()
since the array is small and the overhead of initting a handful of
elements to 0 is small. In general initting memory to zero is a safer
practice and usually it's suggested to only use the non-initting alloc
functions if you really need to.
Let's switch the function to use an allocation function that zeros the
memory. For me, this avoids the crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 6.7 | 6.8.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.8.12-1 | — |
| Debian 13 | linux | 6.8.12-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | linux | 6.8.0-40.40 | USN-6949-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1013.14 | USN-6949-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1012.14 | USN-6952-2 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1012.13 | USN-6949-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1008.11 | USN-6949-1 |
| Ubuntu 24.04 LTS | linux-ibm +2 | 6.8.0-1010.10 | USN-6955-1, USN-6952-1, USN-6949-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1011.11 | USN-6949-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1011.11.1 | USN-6952-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1009.10 | USN-6949-2 |
| Ubuntu 24.04 LTS | linux-riscv +1 | 6.8.0-40.40.1 | USN-6949-2 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1013.14~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1012.14~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1012.13~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-40.40~22.04.3 | — |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1011.11~22.04.1 | USN-6949-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1010.10~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-riscv +22 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 +1 | 6.8.0-40.40.1~22.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +26 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +13 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2008.8 | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1006.6 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | kernel-64kb | 6.4.0-150600.23.14.1 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-docs +5 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| SLES 15 SP6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.0 | kernel-default-base | 6.4.0-17.1.1.51 | SUSE-SU-2025:20008-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-9.1 | SUSE-SU-2025:20028-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-18.1 | SUSE-SU-2025:20008-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6-RT_Update_1 | 1-150600.1.5.1 | SUSE-SU-2024:2973-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_2 | 1-150600.13.3.2 | SUSE-SU-2024:2571-1 |
| SUSE Real Time Module 15 SP6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | dtb-aarch64 +1 | 6.4.0-150600.23.14.1 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-azure +1 | 6.4.0-150600.8.8.2 | SUSE-SU-2024:2896-1 |
| openSUSE Leap 15.6 | kernel-default-base | 6.4.0-150600.23.14.2.150600.12.4.3 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-docs +8 | 6.4.0-150600.23.14.2 | SUSE-SU-2024:2571-1 |
| openSUSE Leap 15.6 | kernel-rt +3 | 6.4.0-150600.10.5.1 | SUSE-SU-2024:2973-1 |
| openSUSE Leap 15.6 | kernel-syms-azure | 6.4.0-150600.8.8.1 | SUSE-SU-2024:2896-1 |
Advisories 11
- USN-6955-1 linux-oem-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6952-2 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6952-1 linux-nvidia-lowlatency, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6949-2 linux-lowlatency, linux-raspi vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- USN-6949-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-nvidia-6.8 vulnerabilities Ubuntu Security Notices (USN) · Oct 26, 2026
- WID-SEC-2024-1418 Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 8, 2026
- SUSE-SU-2025:20008-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20028-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2024:2973-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2896-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2571-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · May 2, 2025