In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: avoid NPD when ASIC does not support DMUB
ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is tested in dm_dmub_sw_init.
However, it will be dereferenced in dmub_hw_lock_mgr_cmd if should_use_dmub_lock returns true.
This has been the case since dmub support has been added for PSR1.
Fix this by checking for dmub_srv in should_use_dmub_lock.
[ 37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058 [ 37.447808] #PF: supervisor read access in kernel mode [ 37.452959] #PF: error_code(0x0000) - not-present page [ 37.458112] PGD 0 P4D 0 [ 37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI [ 37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88 [ 37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023 [ 37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5 [ 37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202 [ 37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358 [ 37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000 [ 37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5 [ 37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000 [ 37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000 [ 37.551725] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000 [ 37.559814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0 [ 37.572697] Call Trace: [ 37.575152] <TASK> [ 37.577258] ? __die_body+0x66/0xb0 [ 37.580756] ? page_fault_oops+0x3e7/0x4a0 [ 37.584861] ? exc_page_fault+0x3e/0xe0 [ 37.588706] ? exc_page_fault+0x5c/0xe0 [ 37.592550] ? asm_exc_page_fault+0x22/0x30 [ 37.596742] ? dmub_hw_lock_mgr_cmd+0x77/0xb0 [ 37.601107] dcn10_cursor_lock+0x1e1/0x240 [ 37.605211] program_cursor_attributes+0x81/0x190 [ 37.609923] commit_planes_for_stream+0x998/0x1ef0 [ 37.614722] update_planes_and_stream_v2+0x41e/0x5c0 [ 37.619703] dc_update_planes_and_stream+0x78/0x140 [ 37.624588] amdgpu_dm_atomic_commit_tail+0x4362/0x49f0 [ 37.629832] ? srso_return_thunk+0x5/0x5f [ 37.633847] ? mark_held_locks+0x6d/0xd0 [ 37.637774] ? _raw_spin_unlock_irq+0x24/0x50 [ 37.642135] ? srso_return_thunk+0x5/0x5f [ 37.646148] ? lockdep_hardirqs_on+0x95/0x150 [ 37.650510] ? srso_return_thunk+0x5/0x5f [ 37.654522] ? _raw_spin_unlock_irq+0x2f/0x50 [ 37.658883] ? srso_return_thunk+0x5/0x5f [ 37.662897] ? wait_for_common+0x186/0x1c0 [ 37.666998] ? srso_return_thunk+0x5/0x5f [ 37.671009] ? drm_crtc_next_vblank_start+0xc3/0x170 [ 37.675983] commit_tail+0xf5/0x1c0 [ 37.679478] drm_atomic_helper_commit+0x2a2/0x2b0 [ 37.684186] drm_atomic_commit+0xd6/0x100 [ 37.688199] ? __cfi___drm_printfn_info+0x10/0x10 [ 37.692911] drm_atomic_helper_update_plane+0xe5/0x130 [ 37.698054] drm_mode_cursor_common+0x501/0x670 [ 37.702600] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.707572] drm_mode_cursor_ioctl+0x48/0x70 [ 37.711851] drm_ioctl_kernel+0xf2/0x150 [ 37.715781] drm_ioctl+0x363/0x590 [ 37.719189] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10 [ 37.724165] amdgpu_drm_ioctl+0x41/0x80 [ 37.728013] __se_sys_ioctl+0x7f/0xd0 [ 37.731685] do_syscall_64+0x87/0x100 [ 37.735355] ? vma_end_read+0x12/0xe0 [ 37.739024] ? srso_return_thunk+0x5/0x5f [ 37.743041] ? find_held_lock+0x47/0xf0 [ 37.746884] ? vma_end_read+0x12/0xe0 [ 37.750552] ? srso_return_thunk+0x5/0 ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Apr 29, 2025 | Apr 16, 2025 |
| Suse | — | Upgrade kernel-azureUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-debugUpgrade kernel-rt-optionalUpgrade kernel-source-vanillaUpgrade kernel-obs-buildUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-source-azureUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade dtb-qcomUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-debug-develUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade dtb-xilinxUpgrade cluster-md-kmp-azureUpgrade dtb-freescaleUpgrade dtb-sprdUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-develUpgrade dtb-exynosUpgrade kernel-64kb-develUpgrade kernel-rt-extraUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-rtUpgrade dtb-caviumUpgrade dtb-hisiliconUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade kernel-64kbUpgrade kernel-default-livepatchUpgrade dtb-mediatekUpgrade kernel-default-develUpgrade dtb-amazonUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade ocfs2-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade dtb-amdUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade dtb-apmUpgrade dtb-marvellUpgrade kernel-default-extraUpgrade reiserfs-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-defaultUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-devel-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-armUpgrade kernel-symsUpgrade dlm-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rtUpgrade dtb-socionextUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade ocfs2-kmp-rt | Dec 5, 2025 | May 21, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-realtimeUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-awsUpgrade linux-image-aws-64kUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-gcpUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-oracle-64kUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1007-raspi | Jun 26, 2025 | Apr 16, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub