CVE-2022-49359

In the Linux kernel, the following vulnerability has been resolved:

drm/panfrost: Job should reference MMU not file_priv

For a while now it's been allowed for a MMU context to outlive it's corresponding panfrost_priv, however the job structure still references panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat.

To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed.

This vulnerability is rated as Important because an authenticated local user with access to the Panfrost DRM device could exploit a use-after-free flaw to induce a kernel crash or potentially elevate privileges on the host. Exploitation is constrained to systems equipped with Arm Mali graphics hardware running the Panfrost driver, which is uncommon in typical enterprise server deployments. Consequently, standard Red Hat installations that do not utilize this specific graphics hardware are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.