CVE-2026-90363

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/msm: don't tear down KMS twice when KMS init fails

When priv->kms_init() (mdp4_kms_init() / mdp5_kms_init()) fails partway

through, both display drivers already tear their KMS state down via

mdp4_destroy() / mdp5_kms_destroy() before returning the error. The

common error path in msm_drm_init() then runs msm_drm_uninit() ->

msm_drm_kms_uninit(), which tries to destroy the very same KMS a second

time, which causes a use-after-free crash.

Bring MDP4/MDP5 in line with the DPU driver whose dpu_kms_init() doesn't

perform error cleanup on the failure. Let the common path own the

cleanup, instead of freeing the KMS from their error paths.

The crash trace for the reference:

__lock_acquire from lock_acquire (kernel/locking/lockdep.c:5906 kernel/locking/lockdep.c:5863)

lock_acquire from touch_wq_lockdep_map (kernel/workqueue.c:4094 (discriminator 1))

touch_wq_lockdep_map from __flush_workqueue (kernel/workqueue.c:4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References