CVE-2024-49901: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-49901 affects the Linux kernel and involves a NULL pointer dereference vulnerability in the drm/msm/adreno GPU driver. The issue was discovered when msm_gpu_cleanup() attempts to call platform_set_drvdata(gpu->pdev, NULL) while gpu->pdev is NULL, occurring when the GPU device has not been fully initialized. This can happen in scenarios such as when speedbin data exists in the catalog but opp-supported-hw is missing in the Device Tree (NVD).

The vulnerability is caused by improper initialization order in the MSM GPU driver code, where gpu->pdev is assigned too late in the initialization sequence. This can lead to a NULL pointer dereference when cleanup is called before full initialization, particularly in error paths. The issue has a CVSS v3.1 Base Score of 5.5 (MEDIUM) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can result in a NULL pointer dereference, potentially causing a system crash (denial of service) when the affected driver encounters certain error conditions during GPU initialization (NVD).

The vulnerability requires local access and low privileges to exploit. It can be triggered through specific error conditions during GPU device initialization, particularly when there are mismatches in device tree configurations (NVD).

The issue has been fixed by moving the assignment of msm_gpu->pdev earlier in the initialization sequence. The fix involves relocating the pdev assignment from msm_gpu_init() to adreno_gpu_init(), ensuring the pointer is set before any potential cleanup paths are triggered (Kernel Patch).