CVE-2026-68429: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

A hotplug or link-loss event can tear down the MST topology
(setting mgr->mst_state = false and mgr->mst_primary = NULL) concurrently
with a caller invoking drm_dp_mst_topology_queue_probe(). Since the check
is already performed under mgr->lock, the condition is not a programming
error but a valid race -- the topology was valid when the caller decided
to call this function, but was torn down before the lock was acquired.

Replace the drm_WARN_ON() with a graceful early return. This eliminates
spurious kernel warnings and the resulting compositor crashes observed
when connecting/disconnecting DP MST monitors, while keeping the correct
behavior of doing nothing when MST is not active. A drm_dbg_mst() trace
is added so the skipped probe remains observable under MST debug logging.

The existing WARN_ON(mgr->mst_primary) in drm_dp_mst_topology_mgr_set_mst()
already catches the case where the topology is initialized twice, so no
diagnostic coverage is lost.

The Linux kernel CVE team has assigned CVE-2026-68429 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.86 with commit 5f57a96e92c60f62da91d58ceb5e5acd40e7d594 and fixed in 6.6.148 with commit b1d05cc61dfa6c4bd5e67855bec6a03e955f512d
	Issue introduced in 6.12 with commit dbaeef363ea54f4c18112874b77503c72ba60fec and fixed in 6.12.101 with commit 4ed6d08c4a59ee6a8cb806347f6d9873de5d229e
	Issue introduced in 6.12 with commit dbaeef363ea54f4c18112874b77503c72ba60fec and fixed in 6.18.42 with commit 8c6d84a54823cd839e6ce22af559925f1320c310
	Issue introduced in 6.12 with commit dbaeef363ea54f4c18112874b77503c72ba60fec and fixed in 7.1.6 with commit afdff9103818656627920c21822e48a6dae2906f
	Issue introduced in 6.12 with commit dbaeef363ea54f4c18112874b77503c72ba60fec and fixed in 7.2-rc2 with commit 613059875958e7b217b250ed14c3b189f9488421

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68429
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/display/drm_dp_mst_topology.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b1d05cc61dfa6c4bd5e67855bec6a03e955f512d
	https://git.kernel.org/stable/c/4ed6d08c4a59ee6a8cb806347f6d9873de5d229e
	https://git.kernel.org/stable/c/8c6d84a54823cd839e6ce22af559925f1320c310
	https://git.kernel.org/stable/c/afdff9103818656627920c21822e48a6dae2906f
	https://git.kernel.org/stable/c/613059875958e7b217b250ed14c3b189f9488421