CVE-2026-90297 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/sun4i: crtc: Propagate layer initialization error
sun4i_crtc_init() returns plain NULL when layer initialization fails, while all its other error paths return an error pointer. The only caller, sun4i_tcon_bind(), checks the result with IS_ERR() and happily continues with tcon->crtc set to NULL. sun4i_rgb_init() and sun4i_lvds_init() then dereference it in drm_crtc_mask(), which oopses.
Return the error pointer instead.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the Linux kernel's display subsystem, specifically affecting the Allwinner Sun4i DRM driver, stems from an inconsistent error handling mechanism during hardware layer initialization. The core issue resides in the sun4i_crtc_init function, which is responsible for setting up a CRTC (Cathode Ray Tube Controller) context for various display interfaces such as RGB and LVDS. When the internal process of initializing specific display layers fails due to resource constraints or configuration errors, this function incorrectly returns a plain NULL pointer rather than an encoded error pointer. This deviation from standard kernel conventions creates a critical logic flaw because all other failure paths within the same function correctly return negative error codes wrapped in pointers using ERR_PTR macros.
The operational impact of this inconsistency is severe and leads to immediate system instability through a null pointer dereference, commonly referred to as a kernel oops or panic. The primary caller of sun4i_crtc_init, specifically the sun4i_tcon_bind function, relies on standard error checking practices by utilizing the IS_ERR macro to validate the return value. Since NULL is not considered an error condition by IS_ERR, the calling code proceeds under the false assumption that initialization was successful and assigns a NULL pointer to tcon->crtc. Subsequently, when subsequent functions such as sun4i_rgb_init or sun4i_lvds_init attempt to interact with this uninitialized CRTC structure, they invoke drm_crtc_mask which directly dereferences the null reference. This action triggers an immediate kernel crash, resulting in system unavailability and potential data loss depending on the context of execution at the time of failure.
From a classification perspective, this vulnerability aligns closely with CWE-476, which denotes NULL Pointer Dereference vulnerabilities where software fails to check for null pointers before using them. Furthermore, it reflects issues related to improper error handling often categorized under CWE-252 or CWE-391 depending on the specific code path analysis, as the root cause is a failure in robustness checks during resource initialization. In terms of adversarial tactics, while this is primarily an unintentional defect rather than a targeted exploit vector, it could be leveraged for denial-of-service attacks if triggered by external inputs that force layer initialization failures, mapping to MITRE ATT&CK techniques involving system availability disruption through software faults.
The resolution involves correcting the return value in sun4i_crtc_init to propagate the actual error pointer instead of returning NULL when layer initialization fails. This ensures consistency with the rest of the driver's error handling logic and allows the caller to correctly identify the failure via IS_ERR checks. By adhering to standard kernel practices where errors are encoded as pointers, the system can gracefully handle failures without proceeding into invalid states that lead to crashes. Mitigation strategies for administrators include applying the latest kernel patches provided by their distribution vendors which incorporate this fix. For developers maintaining custom kernels or embedded systems based on Allwinner hardware, it is critical to ensure that all DRM driver initialization routines strictly follow ERR_PTR conventions and validate return values using IS_ERR rather than simple null checks to prevent similar dereference vulnerabilities in other subsystems.