In the Linux kernel, the following vulnerability has been resolved:
drm/gem: Acquire references on GEM handles for framebuffers
A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below.
[ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]---
Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references.
Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before.
v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernelUpgrade kernel-rt-debugUpgrade kernel-64k-devel-matchedUpgrade kernel-uki-virtUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-docUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade libperfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade python3-perfUpgrade perfUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64kUpgrade kernel-64k-debug-coreUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debugUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-develUpgrade rvUpgrade kernel-tools-libs-develUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modules-extraUpgrade kernel-cross-headersUpgrade kernel-64k-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debugUpgrade kernel-rtUpgrade kernel-rt-64kUpgrade kernel-zfcpdump-modules-core | Sep 17, 2025 | Sep 15, 2025 |
| Amazon_linux_2023 | — | Upgrade perf6.12-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade kernel-livepatch-6.12.40-63.114Upgrade kernel6.12-libbpfUpgrade python3-perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-aarch64 | Sep 16, 2025 | Jul 25, 2025 |
| Debian | — | Upgrade linux | Jul 28, 2025 | Jul 28, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libs | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftool | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel | Sep 12, 2025 | Jul 25, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 31, 2025 | Jul 25, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-develUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade libperf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-libs-develUpgrade rtlaUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-modules-extraUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernel-uki-virt-addonsUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade rvUpgrade libperfUpgrade kernel-rtUpgrade kernel-modules-coreUpgrade kernel-modulesUpgrade kernel-tools-debuginfo | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade dtb-nvidiaUpgrade dtb-qcomUpgrade cluster-md-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-develUpgrade kernel-azure-develUpgrade kernel-symsUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-obs-qaUpgrade dtb-rockchipUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade kselftests-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-devel-rtUpgrade kernel-rt-livepatchUpgrade kernel-64kb-extraUpgrade kernel-rtUpgrade kernel-rt-extraUpgrade kernel-syms-azureUpgrade dtb-sprdUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-macrosUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-default-vdsoUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade dtb-armUpgrade kernel-default-optionalUpgrade dtb-apmUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-hisiliconUpgrade gfs2-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-renesasUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-lgUpgrade dtb-broadcomUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-source-vanillaUpgrade dtb-caviumUpgrade kernel-debugUpgrade dtb-socionextUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade kernel-azureUpgrade kselftests-kmp-azureUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-amazonUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-64kbUpgrade dtb-alteraUpgrade reiserfs-kmp-rtUpgrade dtb-appleUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-default-manUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade kernel-source-azure | Dec 5, 2025 | Sep 12, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-realtimeUpgrade linux-image-azure-fipsUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-6.14Upgrade linux-image-awsUpgrade linux-image-gcp-6.14Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-aws-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-aws-64kUpgrade linux-image-generic-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-azureUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-fips-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-azure-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-oracle-6.8Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-aws-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-24.04aUpgrade linux-image-xilinx-6.8Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-xilinxUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-lowlatency-6.8Upgrade linux-image-virtualUpgrade linux-image-gkeop-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-azure-6.14Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-fipsUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-oem-6.14Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-aws-fipsUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-generic-64k-6.14Upgrade linux-image-nvidia-6.8Upgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracle-6.14 | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub