Samsung Exynos DPU/DRM HDR Driver Memory Flaws

Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.

Use-After-Free in the Samsung Exynos DRM HDR kernel driver causes a kernel crash on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 SoCs. The defect lies in the error-handling path of the HDR driver: when a vmap() call fails, cleanup does not properly invalidate the freed mapping, leaving a dangling reference that is subsequently dereferenced, crashing the kernel. The CVSS vector (AV:L/AC:H/PR:L) indicates a local low-privileged attacker can trigger this under specific error conditions, crossing into kernel scope (S:C). No public exploit code or active exploitation has been identified at time of analysis.

Kernel memory corruption in Samsung Exynos DRM HDR driver affects mobile devices powered by Exynos 1280, 2200, and 1380 SoCs. A heap-based buffer overflow (CWE-122) in the DPU HDR processing path - caused by missing buffer size validation - allows a local low-privileged process to corrupt kernel heap memory and force a system crash. No public exploit has been identified at time of analysis, and Samsung has published a security advisory addressing this issue.

Out-of-bounds write in the Samsung Exynos Display Processing Unit (DPU) kernel driver enables a local low-privileged attacker to corrupt kernel memory and potentially escalate privileges on devices running Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. The flaw stems from missing input length validation in the color mode LUT (Look-Up Table) parsing path of the DPU driver, allowing attacker-controlled data to overflow a kernel buffer. No public exploit code has been identified at time of analysis, though the Samsung semiconductor advisory page confirms the issue and implies a patch is available.

Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.