omapdrm IsrTable UAF

Vulnerability analysis

The OMAP DSI display driver's interrupt handler copies its ISR registration table to a temporary buffer before releasing its spinlock and dispatching interrupt callbacks from that copy. This creates a window where stack-allocated objects referenced by ISR entries can be freed—when the function that registered them returns—while the handler is still iterating over the copy and invoking those callbacks, resulting in a use-after-free. The fix removes the copy entirely and dispatches handlers directly from the live ISR table while the spinlock is still held, closing the race window. This vulnerability is reachable locally on systems with TI OMAP SoC hardware through the DRM display subsystem; a local user with typical display device access can trigger DSI interrupt activity and ISR unregistration without requiring special capabilities.