In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix slab-use-after-free in hdcp
The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpu_dm_connector objects are freed, creating dangling pointers in the HDCP code. When the dock is plugged back, the dangling pointers are dereferenced, resulting in a slab-use-after-free:
[ 66.775837] BUG: KASAN: slab-use-after-free in event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10
[ 66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty #233 [ 66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024 [ 66.776186] Workqueue: events event_property_validate [amdgpu] [ 66.776494] Call Trace: [ 66.776496] <TASK> [ 66.776497] dump_stack_lvl+0x70/0xa0 [ 66.776504] print_report+0x175/0x555 [ 66.776507] ? __virt_addr_valid+0x243/0x450 [ 66.776510] ? kasan_complete_mode_report_info+0x66/0x1c0 [ 66.776515] kasan_report+0xeb/0x1c0 [ 66.776518] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776819] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777121] __asan_report_load4_noabort+0x14/0x20 [ 66.777124] event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777342] ? __lock_acquire+0x6b40/0x6b40 [ 66.777347] ? enable_assr+0x250/0x250 [amdgpu] [ 66.777571] process_one_work+0x86b/0x1510 [ 66.777575] ? pwq_dec_nr_in_flight+0xcf0/0xcf0 [ 66.777578] ? assign_work+0x16b/0x280 [ 66.777580] ? lock_is_held_type+0xa3/0x130 [ 66.777583] worker_thread+0x5c0/0xfa0 [ 66.777587] ? process_one_work+0x1510/0x1510 [ 66.777588] kthread+0x3a2/0x840 [ 66.777591] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777594] ? trace_hardirqs_on+0x4f/0x60 [ 66.777597] ? _raw_spin_unlock_irq+0x27/0x60 [ 66.777599] ? calculate_sigpending+0x77/0xa0 [ 66.777602] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777605] ret_from_fork+0x40/0x90 [ 66.777607] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777609] ret_from_fork_asm+0x11/0x20 [ 66.777614] </TASK>
[ 66.777643] Allocated by task 10: [ 66.777646] kasan_save_stack+0x39/0x60 [ 66.777649] kasan_save_track+0x14/0x40 [ 66.777652] kasan_save_alloc_info+0x37/0x50 [ 66.777655] __kasan_kmalloc+0xbb/0xc0 [ 66.777658] __kmalloc_cache_noprof+0x1c8/0x4b0 [ 66.777661] dm_dp_add_mst_connector+0xdd/0x5c0 [amdgpu] [ 66.777880] drm_dp_mst_port_add_connector+0x47e/0x770 [drm_display_helper] [ 66.777892] drm_dp_send_link_address+0x1554/0x2bf0 [drm_display_helper] [ 66.777901] drm_dp_check_and_send_link_address+0x187/0x1f0 [drm_display_helper] [ 66.777909] drm_dp_mst_link_probe_work+0x2b8/0x410 [drm_display_helper] [ 66.777917] process_one_work+0x86b/0x1510 [ 66.777919] worker_thread+0x5c0/0xfa0 [ 66.777922] kthread+0x3a2/0x840 [ 66.777925] ret_from_fork+0x40/0x90 [ 66.777927] ret_from_fork_asm+0x11/0x20
[ 66.777932] Freed by task 1713: [ 66.777935] kasan_save_stack+0x39/0x60 [ 66.777938] kasan_save_track+0x14/0x40 [ 66.777940] kasan_save_free_info+0x3b/0x60 [ 66.777944] __kasan_slab_free+0x52/0x70 [ 66.777946] kfree+0x13f/0x4b0 [ 66.777949] dm_dp_mst_connector_destroy+0xfa/0x150 [amdgpu] [ 66.778179] drm_connector_free+0x7d/0xb0 [ 66.778184] drm_mode_object_put.part.0+0xee/0x160 [ 66.778188] drm_mode_object_put+0x37/0x50 [ 66.778191] drm_atomic_state_default_clear+0x220/0xd60 [ 66.778194] __drm_atomic_state_free+0x16e/0x2a0 [ 66.778197] drm_mode_atomic_ioctl+0x15ed/0x2ba0 [ 66.778200] drm_ioctl_kernel+0x17a/0x310 [ 66.778203] drm_ioctl+0x584/0xd10 [ 66.778206] amdgpu_drm_ioctl+0xd2/0x1c0 [amdgpu] [ 66.778375] __x64_sys_ioctl+0x139/0x1a0 [ 66.778378] x64_sys_call+0xee7/0xfb0 [ 66.778381] ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux-6.1Upgrade linux | May 28, 2025 | May 20, 2025 |
| Suse | — | Upgrade kernel-develUpgrade kernel-rt-develUpgrade dtb-amdUpgrade kernel-defaultUpgrade kernel-devel-rtUpgrade kernel-default-optionalUpgrade kernel-symsUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-rtUpgrade dtb-allwinnerUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade dtb-appleUpgrade dtb-caviumUpgrade dtb-mediatekUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-freescaleUpgrade dtb-hisiliconUpgrade dlm-kmp-rtUpgrade kernel-azure-optionalUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade dlm-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-xilinxUpgrade reiserfs-kmp-defaultUpgrade dtb-amazonUpgrade ocfs2-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-default-develUpgrade kernel-source-vanillaUpgrade dtb-renesasUpgrade gfs2-kmp-defaultUpgrade dtb-armUpgrade kernel-rt_debug-develUpgrade dtb-alteraUpgrade dtb-socionextUpgrade gfs2-kmp-azureUpgrade kernel-docsUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade kernel-debug-vdsoUpgrade dtb-broadcomUpgrade kernel-source-azureUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-64kbUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-amlogicUpgrade kernel-source-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade dtb-marvellUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade gfs2-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade kernel-docs-htmlUpgrade kernel-rt_debugUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade dtb-lgUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade cluster-md-kmp-default | Dec 5, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-24.04aUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-raspi-6.14Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-aws-64k-6.14Upgrade linux-image-xilinx-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gke-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-azureUpgrade linux-image-virtual-6.14Upgrade linux-image-kvmUpgrade linux-image-oracle-64kUpgrade linux-image-generic-6.14Upgrade linux-image-raspiUpgrade linux-image-oracleUpgrade linux-image-azure-6.8Upgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-gkeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-aws-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-aws-6.14Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-generic-64k-6.14Upgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-oracle-6.8Upgrade linux-image-6.14.0-1009-awsUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-gke-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-oem-22.04bUpgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-awsUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-fipsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-ibm-classicUpgrade linux-image-gcp-fipsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oem-6.14Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-xilinxUpgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-gcpUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-azure-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-6.8Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-fips-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-azure-fips-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-azure-6.14Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-ibmUpgrade linux-image-oem-22.04aUpgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.14.0-1007-oemUpgrade linux-image-virtual-hwe-24.04 | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub