CVE-2026-45956: drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

Synopsis

A use-after-free and out-of-bounds memory access vulnerability exists in the Linux kernel's DRM Exynos vidi display driver. An attacker with local access and a low-privilege account can trigger the flaw by issuing a crafted ioctl call, which causes the driver to resolve the wrong device context pointer. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the affected system. Patched-image rebuilds at the fix versions (5.10.253, 5.15.203, and the upstream commit references) are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to issue the ioctl that triggers the vulnerability.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the flaw entirely through their own process.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout assumptions are required.

Blast Radius

• The attacker reads arbitrary kernel memory, exposing credentials, session tokens, or other sensitive data held in kernel structures.
• The attacker writes to arbitrary kernel memory locations, allowing modification of security-critical kernel state or persisted data structures.
• The attacker can crash the affected system or the display subsystem entirely, causing a denial of service.
• In unlucky memory layouts, a use-after-free condition may allow the attacker to escalate to full kernel code execution.