---
id: CVE-2022-49827
title: 'drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

  drm_vblank_init() call drmm_add_action_or_reset() with
  drm_vblank_init_release() as action. If __drmm_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 <
    1d160dfb3fdf11ba9447e862c548447f91f4e74a
  - >-
    Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 <
    e884a6c2d49a6c12761e5bed851e9fe93bd923a1
  - >-
    Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 <
    3acd2016421b2e628acad65495d15493bf7a3bc3
  - >-
    Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 <
    4979524f5a2a8210e87fde2f642b0dc060860821
  - Linux 5.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:50:08.629890Z'
published: '2025-05-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:00:08.539Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2022-49827'
references:
  - url: 'https://git.kernel.org/stable/c/1d160dfb3fdf11ba9447e862c548447f91f4e74a'
  - url: 'https://git.kernel.org/stable/c/e884a6c2d49a6c12761e5bed851e9fe93bd923a1'
  - url: 'https://git.kernel.org/stable/c/3acd2016421b2e628acad65495d15493bf7a3bc3'
  - url: 'https://git.kernel.org/stable/c/4979524f5a2a8210e87fde2f642b0dc060860821'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12184
ingestedAt: '2026-11-05T22:38:31.614Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

drm_vblank_init() call drmm_add_action_or_reset() with
drm_vblank_init_release() as action. If __drmm_add_action() failed, will
directly call drm_vblank_init_release() with the vblank whose worker is
NULL. As the resule, a null-ptr-deref will happen in
kthread_destroy_worker(). Add the NULL check before calling
drm_vblank_destroy_worker().

BUG: null-ptr-deref
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty
RIP: 0010:kthread_destroy_worker+0x25/0xb0
  Call Trace:
    <TASK>
    drm_vblank_init_release+0x124/0x220 [drm]
    ? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]
    __drmm_add_action_or_reset+0x41/0x50 [drm]
    drm_vblank_init+0x282/0x310 [drm]
    vkms_init+0x35f/0x1000 [vkms]
    ? 0xffffffffc4508000
    ? lock_is_held_type+0xd7/0x130
    ? __kmem_cache_alloc_node+0x1c2/0x2b0
    ? lock_is_held_type+0xd7/0x130
    ? 0xffffffffc4508000
    do_one_initcall+0xd0/0x4f0
    ...
    do_syscall_64+0x35/0x80
    entry_SYSCALL_64_after_hwframe+0x46/0xb0

## Affected

- `Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 < 1d160dfb3fdf11ba9447e862c548447f91f4e74a`
- `Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 < e884a6c2d49a6c12761e5bed851e9fe93bd923a1`
- `Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 < 3acd2016421b2e628acad65495d15493bf7a3bc3`
- `Linux >= 5e6c2b4f916157e8f10d093d43e88b2a250d1774 < 4979524f5a2a8210e87fde2f642b0dc060860821`
- `Linux 5.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.