CVE-2024-38664 Overview
CVE-2024-38664 is a locking vulnerability in the Linux kernel's zynqmp_dpsub Direct Rendering Manager (DRM) driver. The flaw stems from improper initialization of the hpd_mutex lock before it is accessed by the hot-plug detection (HPD) worker. When zynqmp_dp_hpd_work_func calls drm_bridge_hpd_notify, the function attempts to acquire an uninitialized mutex, triggering a lockdep warning and potential undefined behavior on Xilinx ZynqMP platforms. The vulnerability is classified under [CWE-667] (Improper Locking) and affects the Linux kernel through version 6.10-rc1.
Critical Impact
Local attackers with low privileges on affected ZynqMP systems can trigger improper locking behavior that may lead to denial of service, with potential confidentiality, integrity, and availability impact.
Affected Products
- Linux kernel versions prior to fixed stable releases
- Linux kernel 6.10-rc1
- Xilinx ZynqMP platforms using the zynqmp_dpsub DRM driver
Discovery Timeline
- 2024-06-24 - CVE-2024-38664 published to NVD
- 2025-05-30 - Last updated in NVD database
Technical Details for CVE-2024-38664
Vulnerability Analysis
The vulnerability resides in the zynqmp_dpsub DRM subsystem driver, which handles DisplayPort output on Xilinx ZynqMP system-on-chip platforms. The driver fails to register the DRM bridge unconditionally before the hot-plug detection workqueue can execute. As a result, zynqmp_dp_hpd_work_func may run before hpd_mutex is initialized through the bridge registration path.
When the work function executes, it calls drm_bridge_hpd_notify, which attempts to acquire hpd_mutex via mutex_lock_nested. The kernel's lockdep subsystem detects that lock->magic != lock, indicating an uninitialized mutex, and emits a DEBUG_LOCKS_WARN_ON warning at kernel/locking/mutex.c:582. This condition reflects an underlying race between driver initialization and asynchronous HPD event handling.
Root Cause
The root cause is an ordering defect in driver initialization. The original code path registered the DRM bridge inside zynqmp_dpsub_drm_init, which calls drm_bridge_attach. However, the HPD worker can be scheduled before this initialization completes, leading to access of structures whose locks have not been set up. The fix moves bridge registration to occur unconditionally and prior to zynqmp_dpsub_drm_init, ensuring hpd_mutex is initialized before any worker can dereference it.
Attack Vector
Exploitation requires local access with low privileges on a system running an affected Linux kernel on ZynqMP hardware. The vulnerability is not network-reachable and requires no user interaction. Triggering the unsafe code path depends on kernel-internal scheduling and HPD event timing on the affected DisplayPort hardware. The vulnerability manifests during driver probe and HPD handling. Refer to the upstream commit references for technical details on the corrected initialization sequence.
Detection Methods for CVE-2024-38664
Indicators of Compromise
- Kernel log entries containing DEBUG_LOCKS_WARN_ON(lock->magic != lock) originating from __mutex_lock+0x4bc/0x550
- Call traces referencing zynqmp_dp_hpd_work_func and drm_bridge_hpd_notify in dmesg output
- Lockdep warnings on ZynqMP platforms during boot or DisplayPort hot-plug events
Detection Strategies
- Audit running kernel versions across embedded and ZynqMP-based fleets to identify hosts running unpatched releases
- Enable CONFIG_PROVE_LOCKING and CONFIG_DEBUG_MUTEXES in test builds to surface lockdep warnings tied to this code path
- Correlate kernel ring buffer alerts referencing zynqmp_dpsub with system instability or DRM subsystem failures
Monitoring Recommendations
- Forward dmesg and journald kernel logs to a centralized logging or SIEM platform for pattern matching
- Alert on repeated lockdep warnings or DRM bridge errors that may indicate active exploitation attempts or instability
- Track package and kernel version inventory to confirm timely patch deployment on ZynqMP devices
How to Mitigate CVE-2024-38664
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the upstream fix referenced in the kernel.org commits
- Identify all ZynqMP-based systems using the zynqmp_dpsub driver and prioritize them for patching
- Restrict local access to affected systems where patches cannot be applied immediately
Patch Information
The fix was committed upstream and backported to stable kernel branches. Refer to the official commits: Kernel Git Commit 6036613, Kernel Git Commit 6ead3ec, and Kernel Git Commit be3f304. The patch ensures the DRM bridge is always registered before zynqmp_dpsub_drm_init executes, initializing hpd_mutex prior to any HPD worker invocation.
Workarounds
- Disable the zynqmp_dpsub driver module if DisplayPort output is not required on affected hardware
- Limit local user accounts and enforce least-privilege policies until the kernel is patched
- Apply vendor-supplied kernel updates from the Linux distribution maintainer for embedded ZynqMP devices
# Verify current kernel version and identify the zynqmp_dpsub module
uname -r
lsmod | grep zynqmp_dpsub
# Temporarily unload the driver if DisplayPort output is not required
sudo modprobe -r zynqmp_dpsub
# Blacklist the module to prevent loading at boot
echo "blacklist zynqmp_dpsub" | sudo tee /etc/modprobe.d/blacklist-zynqmp-dpsub.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
