In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix slab-use-after-free in hdcp
The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpu_dm_connector objects are freed, creating dangling pointers in the HDCP code. When the dock is plugged back, the dangling pointers are dereferenced, resulting in a slab-use-after-free:
[ 66.775837] BUG: KASAN: slab-use-after-free in event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10
[ 66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty #233 [ 66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024 [ 66.776186] Workqueue: events event_property_validate [amdgpu] [ 66.776494] Call Trace: [ 66.776496] <TASK> [ 66.776497] dump_stack_lvl+0x70/0xa0 [ 66.776504] print_report+0x175/0x555 [ 66.776507] ? __virt_addr_valid+0x243/0x450 [ 66.776510] ? kasan_complete_mode_report_info+0x66/0x1c0 [ 66.776515] kasan_report+0xeb/0x1c0 [ 66.776518] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776819] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777121] __asan_report_load4_noabort+0x14/0x20 [ 66.777124] event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777342] ? __lock_acquire+0x6b40/0x6b40 [ 66.777347] ? enable_assr+0x250/0x250 [amdgpu] [ 66.777571] process_one_work+0x86b/0x1510 [ 66.777575] ? pwq_dec_nr_in_flight+0xcf0/0xcf0 [ 66.777578] ? assign_work+0x16b/0x280 [ 66.777580] ? lock_is_held_type+0xa3/0x130 [ 66.777583] worker_thread+0x5c0/0xfa0 [ 66.777587] ? process_one_work+0x1510/0x1510 [ 66.777588] kthread+0x3a2/0x840 [ 66.777591] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777594] ? trace_hardirqs_on+0x4f/0x60 [ 66.777597] ? _raw_spin_unlock_irq+0x27/0x60 [ 66.777599] ? calculate_sigpending+0x77/0xa0 [ 66.777602] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777605] ret_from_fork+0x40/0x90 [ 66.777607] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777609] ret_from_fork_asm+0x11/0x20 [ 66.777614] </TASK>
[ 66.777643] Allocated by task 10: [ 66.777646] kasan_save_stack+0x39/0x60 [ 66.777649] kasan_save_track+0x14/0x40 [ 66.777652] kasan_save_alloc_info+0x37/0x50 [ 66.777655] __kasan_kmalloc+0xbb/0xc0 [ 66.777658] __kmalloc_cache_noprof+0x1c8/0x4b0 [ 66.777661] dm_dp_add_mst_connector+0xdd/0x5c0 [amdgpu] [ 66.777880] drm_dp_mst_port_add_connector+0x47e/0x770 [drm_display_helper] [ 66.777892] drm_dp_send_link_address+0x1554/0x2bf0 [drm_display_helper] [ 66.777901] drm_dp_check_and_send_link_address+0x187/0x1f0 [drm_display_helper] [ 66.777909] drm_dp_mst_link_probe_work+0x2b8/0x410 [drm_display_helper] [ 66.777917] process_one_work+0x86b/0x1510 [ 66.777919] worker_thread+0x5c0/0xfa0 [ 66.777922] kthread+0x3a2/0x840 [ 66.777925] ret_from_fork+0x40/0x90 [ 66.777927] ret_from_fork_asm+0x11/0x20
[ 66.777932] Freed by task 1713: [ 66.777935] kasan_save_stack+0x39/0x60 [ 66.777938] kasan_save_track+0x14/0x40 [ 66.777940] kasan_save_free_info+0x3b/0x60 [ 66.777944] __kasan_slab_free+0x52/0x70 [ 66.777946] kfree+0x13f/0x4b0 [ 66.777949] dm_dp_mst_connector_destroy+0xfa/0x150 [amdgpu] [ 66.778179] drm_connector_free+0x7d/0xb0 [ 66.778184] drm_mode_object_put.part.0+0xee/0x160 [ 66.778188] drm_mode_object_put+0x37/0x50 [ 66.778191] drm_atomic_state_default_clear+0x220/0xd60 [ 66.778194] __drm_atomic_state_free+0x16e/0x2a0 [ 66.778197] drm_mode_atomic_ioctl+0x15ed/0x2ba0 [ 66.778200] drm_ioctl_kernel+0x17a/0x310 [ 66.778203] drm_ioctl+0x584/0xd10 [ 66.778206] amdgpu_drm_ioctl+0xd2/0x1c0 [amdgpu] [ 66.778375] __x64_sys_ioctl+0x139/0x1a0 [ 66.778378] x64_sys_call+0xee7/0xfb0 [ 66.778381] ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | May 28, 2025 | May 20, 2025 |
| Suse | — | Upgrade kernel-azure-optionalUpgrade kernel-default-baseUpgrade dtb-hisiliconUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-symsUpgrade dlm-kmp-rtUpgrade dtb-xilinxUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-armUpgrade kernel-64kb-develUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade kernel-64kb-extraUpgrade dtb-alteraUpgrade kselftests-kmp-rtUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt_debug-develUpgrade dtb-caviumUpgrade kernel-rt-develUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-develUpgrade kernel-docsUpgrade kernel-debugUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade dtb-renesasUpgrade kernel-azureUpgrade dtb-amazonUpgrade kernel-azure-extraUpgrade kernel-default-optionalUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dtb-appleUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-kvmsmallUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade kernel-rt-extraUpgrade dlm-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade dtb-apmUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade cluster-md-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-exynosUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-default-vdsoUpgrade kernel-macrosUpgrade kernel-source-rtUpgrade kernel-source-azureUpgrade kernel-rt_debugUpgrade kernel-docs-htmlUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-obs-build | Dec 5, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-oracle-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-gke-64kUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-oem-22.04bUpgrade linux-image-aws-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-kvmUpgrade linux-image-virtual-6.14Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-gkeUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-generic-6.14Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-awsUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-gcp-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oem-24.04cUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gkeopUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-virtualUpgrade linux-image-raspi-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-fips-6.8Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-azure-fipsUpgrade linux-image-azure-6.14Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oem-22.04cUpgrade linux-image-intel-iotgUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-genericUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.14.0-24-genericUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-ibmUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-nvidiaUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-6.14Upgrade linux-image-xilinx | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub