CVE-2026-68429

drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

N/A
Published: August 12, 2026 at 12:07 AM UTC
Updated: August 17, 2026 at 06:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.12 ≤ v < 6.12.1016.12 ≤ v < 6.18.426.12 ≤ v < 7.1.66.12 ≤ v < 7.26.6.86 ≤ v < 6.6.1485f57a96e92c60f62da91d58ceb5e5acd40e7d5946.126.6.86dbaeef363ea54f4c18112874b77503c72ba60fec
Vendor states this is fixed in 4ed6d08c4a59ee6a8cb806347f6d9873de5d229e (fixed)
Vendor states this is fixed in 613059875958e7b217b250ed14c3b189f9488421 (fixed)
Vendor states this is fixed in 8c6d84a54823cd839e6ce22af559925f1320c310 (fixed)
Vendor states this is fixed in afdff9103818656627920c21822e48a6dae2906f (fixed)
Vendor states this is fixed in b1d05cc61dfa6c4bd5e67855bec6a03e955f512d (fixed)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.12.101 (unaffected)
Vendor states this is fixed in 6.18.42 (unaffected)
Vendor states this is fixed in 6.6.148 (unaffected)
Vendor states this is fixed in 7.1.6 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card