CVE-2024-56537: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-56537 affects the Linux kernel's display driver subsystem, specifically the Xilinx ZynqMP display driver. The vulnerability was discovered and disclosed in December 2024, affecting Linux kernel versions from 6.10 up to (excluding) 6.11.11 and from 6.12 up to (excluding) 6.12.2. The issue involves a potential NULL pointer dereference in the zynqmp_disp driver (NVD).

The vulnerability is a NULL pointer dereference issue in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically in the Xilinx ZynqMP display driver. The bug occurs when layer->info can be null during the first layer creation in zynqmp_disp_create_layers function. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access is required and the primary impact is on availability (NVD).

The vulnerability can lead to a NULL pointer dereference, which could result in a system crash (denial of service) when the affected driver is in use. The impact is limited to systems using the Xilinx ZynqMP display driver (NVD).

The vulnerability has been fixed in Linux kernel versions 6.11.11 and 6.12.2. The fix involves adding a NULL pointer check before accessing layer->info in the zynqmp_disp_layer_release_dma function (Kernel Patch).