CVE-2024-27041: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's AMD display driver (amdgpu_dm.c) where a NULL pointer dereference could occur in the amdgpu_dm_fini() function. The vulnerability was identified by the Linux Verification Center using their static analysis tool SVACE and was assigned CVE-2024-27041. The issue was disclosed on May 1, 2024, and affects the AMD GPU display driver in the Linux kernel (Kernel Git).

The vulnerability stems from insufficient NULL pointer checks in the amdgpu_dm_fini() function. Specifically, 'adev->dm.dc' could be NULL before calling dc_enable_dmub_notifications(), potentially leading to a NULL pointer dereference. Additionally, there were separate NULL checks for 'adev->dm.dc' before dc_deinit_callbacks() and dc_dmub_srv_destroy() calls that needed to be consolidated. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

If exploited, this vulnerability could lead to a denial of service condition through a system crash caused by the NULL pointer dereference. The impact is limited to availability with no direct effect on confidentiality or integrity of the system (CISA-ADP).

The vulnerability requires local access with low privileges to exploit. No public exploits have been reported in the wild. The attack complexity is considered low, but user interaction is not required for exploitation (NVD).

The vulnerability has been fixed by combining all NULL checks under a single 'if' statement and ensuring proper validation before accessing the pointer. The fix was implemented in commit 2a3cfb9a24a28da9cc13d2c525a76548865e182c and has been backported to various stable kernel versions (Kernel Git).