In the Linux kernel, the following vulnerability has been resolved:
drm/dpmst: Ensure mstprimary pointer is valid in drmdpmsthandleup_req()
While receiving an MST up request message from one thread in drmdpmsthandleupreq(), the MST topology could be removed from another thread via drmdpmsttopologymgrsetmst(false), freeing mstprimary and setting drmdpmsttopologymgr::mstprimary to NULL. This could lead to a NULL deref/use-after-free of mstprimary in drmdpmsthandleup_req().
Avoid the above by holding a reference for mstprimary in drmdpmsthandleupreq() while it's used.
v2: Fix kfreeing the request if getting an mst_primary reference fails.