CVE-2024-26607: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26607 affects the Linux kernel's DRM bridge sii902x driver, where a null pointer dereference vulnerability was discovered. The issue occurs on TI platforms using the sii9022 bridge during the device probing sequence, specifically when the sii902x driver attempts to read EDID information before the I2C interface is properly initialized (NVD).

The vulnerability stems from a race condition in the driver initialization sequence. The issue occurs when the tidss driver probe is deferred while sii902x is missing, followed by sii902x probing that calls drm_bridge_add() before the I2C interface is fully configured. This premature registration allows the tidss driver to attempt EDID reading through sii902x_bridge_get_edid() before the I2C setup is complete, resulting in a null pointer dereference (Kernel Patch). The vulnerability has been assigned a CVSS v3.1 base score of 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a system crash (denial of service) through a null pointer dereference in the sii902x driver. The impact is primarily limited to system availability, with no direct impact on confidentiality or integrity (NVD).

The vulnerability requires local access and specific timing conditions to be exploited. It affects Linux kernel versions from 5.0 up to (excluding) 6.1.76, from 6.2 up to (excluding) 6.6.15, from 6.7 up to (excluding) 6.7.3, and version 6.8-rc1 (NVD).

The vulnerability has been fixed by moving the drm_bridge_add() call to the end of the sii902x_init() function, ensuring proper I2C initialization before the bridge becomes available to the DRM subsystem. Users should update their Linux kernel to versions 6.1.76, 6.6.15, or 6.7.3 or later, depending on their kernel series (Kernel Patch).