CVE-2024-26661: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26661 affects the Linux kernel's AMD display driver, specifically in the 'dcn21_set_pipe()' function. The vulnerability was discovered and disclosed on April 2, 2024, where a NULL pointer dereference issue was identified in the timing generator component. The vulnerability affects various Linux kernel versions and distributions including Ubuntu and Huawei EulerOS (NVD).

The vulnerability exists in the Linux kernel's AMD display driver where the 'dcn21_set_pipe()' function does not properly validate the timing generator pointer before dereferencing it. Specifically, in the code 'u32 otg_inst = pipe_ctx->stream_res.tg->inst', pipe_ctx->stream_res.tg could be NULL, as it relies on the caller to ensure the timing generator is not NULL. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to a NULL pointer dereference, which could result in a denial of service condition through a system crash. The impact is primarily limited to availability, with no direct impact on confidentiality or integrity of the system (CISA-ADP).

The vulnerability requires local access and low privileges to exploit. It has been classified as a NULL Pointer Dereference (CWE-476) vulnerability. The attack complexity is considered low, but requires local access to the system (NVD).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for affected versions: Ubuntu 23.10 (linux 6.5.0-44.44), Ubuntu 22.04 LTS (linux 5.15.0-125.135), and other distributions. Users are advised to update their systems to the patched versions. The fix involves adding proper NULL pointer validation before accessing the timing generator instance (Ubuntu).