VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jul 12, 2024· Updated May 12, 2026

CVE-2024-40916

CVE-2024-40916

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found

When reading EDID fails and driver reports no modes available, the DRM core adds an artificial 1024x786 mode to the connector. Unfortunately some variants of the Exynos HDMI (like the one in Exynos4 SoCs) are not able to drive such mode, so report a safe 640x480 mode instead of nothing in case of the EDID reading failure.

This fixes the following issue observed on Trats2 board since commit 13d5b040363c ("drm/exynos: do not return negative values from .get_modes()"):

[drm] Exynos DRM: using 11c00000.fimd device for DMA mapping operations exynos-drm exynos-drm: bound 11c00000.fimd (ops fimd_component_ops) exynos-drm exynos-drm: bound 12c10000.mixer (ops mixer_component_ops) exynos-dsi 11c80000.dsi: [drm:samsung_dsim_host_attach] Attached s6e8aa0 device (lanes:4 bpp:24 mode-flags:0x10b) exynos-drm exynos-drm: bound 11c80000.dsi (ops exynos_dsi_component_ops) exynos-drm exynos-drm: bound 12d00000.hdmi (ops hdmi_component_ops) [drm] Initialized exynos 1.1.0 20180330 for exynos-drm on minor 1 exynos-hdmi 12d00000.hdmi: [drm:hdmiphy_enable.part.0] *ERROR* PLL could not reach steady state panel-samsung-s6e8aa0 11c80000.dsi.0: ID: 0xa2, 0x20, 0x8c exynos-mixer 12c10000.mixer: timeout waiting for VSYNC ------------[ cut here ]------------ WARNING: CPU: 1 PID: 11 at drivers/gpu/drm/drm_atomic_helper.c:1682 drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 [CRTC:70:crtc-1] vblank wait timed out Modules linked in: CPU: 1 PID: 11 Comm: kworker/u16:0 Not tainted 6.9.0-rc5-next-20240424 #14913 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound deferred_probe_work_func Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x68/0x88 dump_stack_lvl from __warn+0x7c/0x1c4 __warn from warn_slowpath_fmt+0x11c/0x1a8 warn_slowpath_fmt from drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 drm_atomic_helper_wait_for_vblanks.part.0 from drm_atomic_helper_commit_tail_rpm+0x7c/0x8c drm_atomic_helper_commit_tail_rpm from commit_tail+0x9c/0x184 commit_tail from drm_atomic_helper_commit+0x168/0x190 drm_atomic_helper_commit from drm_atomic_commit+0xb4/0xe0 drm_atomic_commit from drm_client_modeset_commit_atomic+0x23c/0x27c drm_client_modeset_commit_atomic from drm_client_modeset_commit_locked+0x60/0x1cc drm_client_modeset_commit_locked from drm_client_modeset_commit+0x24/0x40 drm_client_modeset_commit from __drm_fb_helper_restore_fbdev_mode_unlocked+0x9c/0xc4 __drm_fb_helper_restore_fbdev_mode_unlocked from drm_fb_helper_set_par+0x2c/0x3c drm_fb_helper_set_par from fbcon_init+0x3d8/0x550 fbcon_init from visual_init+0xc0/0x108 visual_init from do_bind_con_driver+0x1b8/0x3a4 do_bind_con_driver from do_take_over_console+0x140/0x1ec do_take_over_console from do_fbcon_takeover+0x70/0xd0 do_fbcon_takeover from fbcon_fb_registered+0x19c/0x1ac fbcon_fb_registered from register_framebuffer+0x190/0x21c register_framebuffer from __drm_fb_helper_initial_config_and_unlock+0x350/0x574 __drm_fb_helper_initial_config_and_unlock from exynos_drm_fbdev_client_hotplug+0x6c/0xb0 exynos_drm_fbdev_client_hotplug from drm_client_register+0x58/0x94 drm_client_register from exynos_drm_bind+0x160/0x190 exynos_drm_bind from try_to_bring_up_aggregate_device+0x200/0x2d8 try_to_bring_up_aggregate_device from __component_add+0xb0/0x170 __component_add from mixer_probe+0x74/0xcc mixer_probe from platform_probe+0x5c/0xb8 platform_probe from really_probe+0xe0/0x3d8 really_probe from __driver_probe_device+0x9c/0x1e4 __driver_probe_device from driver_probe_device+0x30/0xc0 driver_probe_device from __device_attach_driver+0xa8/0x120 __device_attach_driver from bus_for_each_drv+0x80/0xcc bus_for_each_drv from __device_attach+0xac/0x1fc __device_attach from bus_probe_device+0x8c/0x90 bus_probe_device from deferred_probe_work_func+0 ---truncated---

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing EDID fallback in Exynos HDMI causes a warning when the driver cannot drive the 1024x768 mode added by DRM core, fixed by reporting safe 640x480 mode.

Vulnerability

Description

In the Linux kernel's drm/exynos HDMI driver, when reading EDID fails, the DRM core automatically adds an artificial 1024x768 mode to the connector. However, certain Exynos HDMI variants (e.g., on Exynos4 SoCs) cannot drive this mode. This mismatch leads to a kernel warning: *"drm_atomic_helper_wait_for_vblanks.part.0+0x2b0/0x2b8 [CRTC:70:crtc-1] vblank wait timed out"* as observed on the Trats2 board. The patch replaces the default fallback with a safe 640x480 mode, preventing the hardware lockup and warning [1][2].

Exploitation

No special privilege or user interaction is needed to trigger the bug—it occurs automatically during normal HDMI initialization if EDID fails to read and the driver attempts to apply the unsupported 1024x768 mode. The attack surface is local; an attacker with physical access could force the bug by disconnecting the display or corrupting the EDID, causing repeated kernel warnings and potential denial of service.

Impact

A remote attacker cannot exploit this directly. However, the bug manifests as a kernel warning, which can cause system instability or a denial-of-service condition (WARN_ON splat and vblank timeout). Systems with affected Exynos HDMI hardware (e.g., Exynos4-based devices) and without an EDID-capable display experience the issue every boot.

Mitigation

The vulnerability is fixed in the Linux kernel stable tree via commits [3] and [4]. Users should apply the kernel update that includes the safe fallback mode. No workaround exists beyond ensuring a valid EDID is provided by the display. The CVE is not on the CISA KEV list.

References
  1. SSA-355557
  2. SSA-265688
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

102

Patches

7
c3ca24dfe9a2
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
6d6bb258d886
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
4dfffb50316c
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
e23f2eaf51ec
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
799d4b392417
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
510a6c0dfa6e
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit
35bcf16b4a28
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitvia osv
commit

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.