CVE-2026-31562：Linux内核Mediatek DSI驱动空指针解引用漏洞

// Conceptual PoC demonstrating the trigger sequence (Driver context) // This represents the vulnerable flow in the driver. #include <linux/module.h> #include <drm/drm_mipi_dsi.h> // Simulating the vulnerable probe function static int vulnerable_mtk_dsi_probe(struct platform_device *pdev) { struct mtk_dsi *dsi; // ... memory allocation ... // VULNERABILITY: drvdata is NOT set here // dev_set_drvdata(&pdev->dev, dsi); // <--- MISSING FIX // This call triggers mtk_dsi_bind -> dev_get_drvdata // which returns NULL because the above line is missing. mipi_dsi_host_register(dsi->host); return 0; } // To trigger this PoC on an affected device: // 1. Load the mediatek-drm module or boot the device. // 2. The kernel will crash during the probe phase with: // "Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040"