CVE-2026-53058

drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()

MEDIUM
5.5
CVSS Score
Published: June 24, 2026 at 04:30 PM UTC
Updated: July 21, 2026 at 05:49 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() In case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read() in atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit NULL pointer while trying to access the mutex. We need the connector to be set before that. Unlike in legacy cases with flag !DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised in bridge_attach(), so add the mhdp->connector_ptr in device structure to handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and !DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to avoid possible NULL pointer dereference in recovery paths like modeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.13 ≤ v < 6.18.336.19 ≤ v < 7.0.106.6 ≤ v < 6.12.916.6 ≤ v < 6.18.336.6 ≤ v < 6.6.1416.6 ≤ v < 7.0.106.6 ≤ v < 7.16.7 ≤ v < 6.12.916.6c932ced6b58524eeb948ff252f6512cd6bcb9d9f
Vendor states this is fixed in 1af3b42e08a957e53bab8e1897393fe0a27d9fbf (fixed)
Vendor states this is fixed in 43d6508ddbf9fb974fbc359a033154f78c9d4c8b (fixed)
Vendor states this is fixed in 5302015daf26ef6b48e067f2b86c9482ac19e015 (fixed)
Vendor states this is fixed in a3611554e599d1a24b45fd8415bacb72ce861e4b (fixed)
Vendor states this is fixed in cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575 (fixed)
Vendor states this is fixed in 6.12.91 (unaffected)
Vendor states this is fixed in 6.18.33 (unaffected)
Vendor states this is fixed in 6.6 (unaffected)
Vendor states this is fixed in 6.6.141 (unaffected)
Vendor states this is fixed in 7.0.10 (unaffected)
Vendor states this is fixed in 7.1 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card