Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-68429— drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于热插拔或链路丢失事件与调用drm_dp_mst_topology_queue_probe()并发导致MST拓扑拆除时存在竞争条件，可能引发虚假内核警告和合成器崩溃。

AI Predicted 5.5 Difficulty: Trivial EPSS 0.17% · P6

Affected Version Matrix 13

VendorProduct Version RangeStatus
Linux Linux 5f57a96e92c60f62da91d58ceb5e5acd40e7d594< b1d05cc61dfa6c4bd5e67855bec6a03e955f512d affected
dbaeef363ea54f4c18112874b77503c72ba60fec< 4ed6d08c4a59ee6a8cb806347f6d9873de5d229e affected
dbaeef363ea54f4c18112874b77503c72ba60fec< 8c6d84a54823cd839e6ce22af559925f1320c310 affected
dbaeef363ea54f4c18112874b77503c72ba60fec< afdff9103818656627920c21822e48a6dae2906f affected
dbaeef363ea54f4c18112874b77503c72ba60fec< 613059875958e7b217b250ed14c3b189f9488421 affected
6.6.86< 6.6.148 affected
6.12 affected
< 6.12 unaffected
… +5 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68429

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check is already performed under mgr->lock, the condition is not a programming error but a valid race -- the topology was valid when the caller decided to call this function, but was torn down before the lock was acquired. Replace the drm_WARN_ON() with a graceful early return. This eliminates spurious kernel warnings and the resulting compositor crashes observed when connecting/disconnecting DP MST monitors, while keeping the correct behavior of doing nothing when MST is not active. A drm_dbg_mst() trace is added so the skipped probe remains observable under MST debug logging. The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst() already catches the case where the topology is initialized twice, so no diagnostic coverage is lost.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于热插拔或链路丢失事件与调用drm_dp_mst_topology_queue_probe()并发导致MST拓扑拆除时存在竞争条件，可能引发虚假内核警告和合成器崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5f57a96e92c60f62da91d58ceb5e5acd40e7d594 ~ b1d05cc61dfa6c4bd5e67855bec6a03e955f512d -
Linux Linux 6.12 -

II. Public POCs for CVE-2026-68429

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68429

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68429 (5)

Same Patch Batch · Linux · 2026-08-12 · 22 CVEs total

CVE-2026-68431 9.1 CRITICAL ksmbd: validate minimum PDU size for transform requests
CVE-2026-68432 8.8 HIGH vxlan: require CAP_NET_ADMIN in the device netns for changelink
CVE-2026-68433 8.6 HIGH libceph: bound get_version reply decode to front len
CVE-2026-68440 7.8 HIGH net: txgbe: fix heap overflow when reading module EEPROM
CVE-2026-68446 7.8 HIGH drm/vmwgfx: Validate vmw_surface_metadata::array_size
CVE-2026-68445 7.8 HIGH drm/vc4: Prevent shader BO mappings from becoming writable
CVE-2026-68442 7.8 HIGH btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
CVE-2026-68447 7.1 HIGH drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
CVE-2026-68437 drm/imagination: Fit paired fragment job in the correct CCCB
CVE-2026-68438 smp: Make CSD lock acquisition atomic for debug mode
CVE-2026-68439 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
CVE-2026-68430 drm/amdgpu/gfx8: drop unecessary BUG_ON()
CVE-2026-68441 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
CVE-2026-68436 drm/amd/display: use kvzalloc to allocate struct dc
CVE-2026-68443 hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
CVE-2026-68444 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
CVE-2026-68435 LoongArch: Fix address space mismatch in kexec command line lookup
CVE-2026-68434 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
CVE-2026-68448 ovl: check access to copy_file_range source with src mounter creds
CVE-2026-68449 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Showing top 20 of 22 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68429

No comments yet

Leave a comment