CVE-2022-49203: drm/amd/display: Fix double free during GPU reset on DC streams
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix double free during GPU reset on DC streams
[Why]
The issue only occurs during the GPU reset code path.
We first backup the current state prior to commiting 0 streams
internally from DM to DC. This state backup contains valid link
encoder assignments.
DC will clear the link encoder assignments as part of current state
(but not the backup, since it was a copied before the commit) and
free the extra stream reference it held.
DC requires that the link encoder assignments remain cleared/invalid
prior to commiting. Since the backup still has valid assignments we
call the interface post reset to clear them. This routine also
releases the extra reference that the link encoder interface held -
resulting in a double free (and eventually a NULL pointer dereference).
[How]
We'll have to do a full DC commit anyway after GPU reset because
the stream count previously went to 0.
We don't need to retain the assignment that we had backed up, so
just copy off of the now clean current state assignment after the
reset has occcurred with the new link_enc_cfg_copy() interface.
Security readout for executives and security teams
Plain-English summary
CVE-2022-49203 is a Linux kernel AMD display driver bug that can crash affected systems during a GPU reset. It is an availability issue, not a data theft or privilege-escalation issue based on the supplied CVSS data.
Executive priority
Treat this as a moderate availability risk. Patch during normal kernel maintenance unless affected systems are business-critical workstations, kiosks, rendering nodes, or other AMD GPU systems where crashes have operational impact.
Technical view
The flaw is a double free in drm/amd/display during the GPU reset path for DC streams. A stale backup state can retain link encoder assignments, causing an extra reference release after reset and leading to a NULL pointer dereference.
Likely exposure
Exposure is most likely on Linux systems using affected 5.17-era kernels with AMD GPU display functionality. The source bundle does not provide distribution-specific package names, CPEs, or cloud image mappings.
Exploitation context
The CVSS vector requires local access and low privileges, with no user interaction. The source bundle marks KEV as false and provides no cited evidence of active exploitation.
Researcher notes
Evidence is limited to the kernel CVE description and stable commit references. The bug is constrained to the GPU reset path. Do not assume remote reachability, data exposure, or exploitation without additional vendor or incident evidence.
Mitigation direction
Upgrade to a Linux kernel containing the cited stable fixes or vendor backport.
Check distribution kernel advisories for CVE-2022-49203 coverage.
Prioritize systems with AMD GPUs and graphical/display workloads.
Schedule updates where GPU reset crashes would affect service availability.
Validation and detection
Inventory Linux kernel versions across AMD GPU systems.
Confirm whether the amdgpu display stack is present and active.
Verify vendor kernel changelogs include the referenced stable commits.
Review crash logs for GPU reset, double free, or NULL dereference symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.