CVE-2026-80658: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80658 Overview

CVE-2026-80658 is a null pointer dereference vulnerability in the Linux kernel's Rockchip DisplayPort (DP) driver. The flaw resides in the dw_dp_remove() platform driver callback within drm/rockchip: dw_dp. The remove path attempts to access driver data that may never have been initialized by platform_set_drvdata() if the component ->bind() callback did not execute. This scenario occurs when the Rockchip DRM driver fails to complete component_bind_all() due to an unrelated error causing early return from rockchip_drm_bind(). Triggering the condition results in a null pointer dereference in kernel space, leading to a kernel oops or system crash.

Critical Impact
A null pointer dereference in the kernel remove path can produce a denial-of-service condition through kernel panic on affected Rockchip DRM systems.

Affected Products

Linux kernel builds including the drm/rockchip DisplayPort driver (dw_dp)
Rockchip SoC-based platforms using the DesignWare DP bridge
Distributions shipping vulnerable kernel versions prior to the referenced stable commits

Discovery Timeline

2026-08-28 - CVE-2026-80658 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80658

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-476] in the Rockchip DesignWare DisplayPort driver. The Linux component framework binds subordinate devices through the ->bind() callback of each component. In the affected code, dw_dp_bind() invokes platform_set_drvdata() to associate the driver-private structure with the platform device. The dw_dp_remove() callback then calls platform_get_drvdata() to retrieve that pointer during teardown.

When rockchip_drm_bind() fails before component_bind_all() executes successfully, the dw_dp component's ->bind() may never run. As a result, platform_set_drvdata() is not called, and the platform device's driver data remains NULL. Any subsequent module unload or device removal invokes dw_dp_remove(), which dereferences the NULL pointer.

Root Cause

The root cause is an unsafe ordering assumption in the platform driver lifecycle. The remove() callback presumes that bind() completed and populated driver data, but the component framework provides no such guarantee. The upstream fix removes the reliance on platform_get_drvdata() and instead references the target device structure directly through the platform_device argument passed to remove().

Attack Vector

Exploitation requires local access to trigger the failure path during Rockchip DRM initialization or to unbind the driver. This is a reliability and denial-of-service issue rather than a remotely reachable code execution flaw. The affected code path executes in kernel context, so a successful dereference results in a kernel oops. See the upstream patches for the exact code changes: Kernel Git Commit 33bc9fba, Kernel Git Commit 9456381d, and Kernel Git Commit b3ec263a.

No verified proof-of-concept code is available; the vulnerability is described in prose based on the upstream commit messages.

Detection Methods for CVE-2026-80658

Indicators of Compromise

Kernel oops or panic messages referencing dw_dp_remove in the call stack
NULL pointer dereference entries in dmesg correlated with Rockchip DRM initialization failure
Failed rockchip_drm_bind() messages preceding a driver unload or module removal event

Detection Strategies

Inspect kernel logs on Rockchip-based devices for component_bind_all failures followed by remove-path crashes
Compare installed kernel package versions against distribution advisories referencing the fix commits
Enable kdump or pstore to capture crash dumps for post-incident analysis on affected platforms

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log platform for anomaly review
Alert on repeated kernel oops events involving DRM subsystem modules
Track kernel version inventory across Rockchip SoC fleets to identify unpatched hosts

How to Mitigate CVE-2026-80658

Immediate Actions Required

Apply the upstream stable kernel patches referenced by commits 33bc9fba, 9456381d, and b3ec263a
Update to a distribution kernel release that includes the dw_dp_remove() fix
Restrict local access to affected devices while patches are being staged

Patch Information

The fix drops the unnecessary call to platform_get_drvdata() in dw_dp_remove() and references the device structure through the platform_device argument. Patched kernels are available via the stable tree commits 33bc9fba, 9456381d, and b3ec263a.

Workarounds

Avoid unbinding or unloading the dw_dp module on systems where rockchip_drm_bind() has failed
Blacklist the dw_dp module on Rockchip platforms that do not require DisplayPort output until patches are applied
Ensure dependent DRM components initialize cleanly to prevent the failure path from being triggered

bash

# Verify kernel version and check for the fix
uname -r
# Blacklist dw_dp temporarily if unused on the platform
echo 'blacklist dw_dp' | sudo tee /etc/modprobe.d/blacklist-dw_dp.conf
sudo update-initramfs -u