In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix slab-use-after-free in hdcp
The HDCP code in amdgpu_dm_hdcp.c copies pointers to amdgpu_dm_connector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpu_dm_connector objects are freed, creating dangling pointers in the HDCP code. When the dock is plugged back, the dangling pointers are dereferenced, resulting in a slab-use-after-free:
[ 66.775837] BUG: KASAN: slab-use-after-free in event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10
[ 66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty #233 [ 66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024 [ 66.776186] Workqueue: events event_property_validate [amdgpu] [ 66.776494] Call Trace: [ 66.776496] <TASK> [ 66.776497] dump_stack_lvl+0x70/0xa0 [ 66.776504] print_report+0x175/0x555 [ 66.776507] ? __virt_addr_valid+0x243/0x450 [ 66.776510] ? kasan_complete_mode_report_info+0x66/0x1c0 [ 66.776515] kasan_report+0xeb/0x1c0 [ 66.776518] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.776819] ? event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777121] __asan_report_load4_noabort+0x14/0x20 [ 66.777124] event_property_validate+0x42f/0x6c0 [amdgpu] [ 66.777342] ? __lock_acquire+0x6b40/0x6b40 [ 66.777347] ? enable_assr+0x250/0x250 [amdgpu] [ 66.777571] process_one_work+0x86b/0x1510 [ 66.777575] ? pwq_dec_nr_in_flight+0xcf0/0xcf0 [ 66.777578] ? assign_work+0x16b/0x280 [ 66.777580] ? lock_is_held_type+0xa3/0x130 [ 66.777583] worker_thread+0x5c0/0xfa0 [ 66.777587] ? process_one_work+0x1510/0x1510 [ 66.777588] kthread+0x3a2/0x840 [ 66.777591] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777594] ? trace_hardirqs_on+0x4f/0x60 [ 66.777597] ? _raw_spin_unlock_irq+0x27/0x60 [ 66.777599] ? calculate_sigpending+0x77/0xa0 [ 66.777602] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777605] ret_from_fork+0x40/0x90 [ 66.777607] ? kthread_is_per_cpu+0xd0/0xd0 [ 66.777609] ret_from_fork_asm+0x11/0x20 [ 66.777614] </TASK>
[ 66.777643] Allocated by task 10: [ 66.777646] kasan_save_stack+0x39/0x60 [ 66.777649] kasan_save_track+0x14/0x40 [ 66.777652] kasan_save_alloc_info+0x37/0x50 [ 66.777655] __kasan_kmalloc+0xbb/0xc0 [ 66.777658] __kmalloc_cache_noprof+0x1c8/0x4b0 [ 66.777661] dm_dp_add_mst_connector+0xdd/0x5c0 [amdgpu] [ 66.777880] drm_dp_mst_port_add_connector+0x47e/0x770 [drm_display_helper] [ 66.777892] drm_dp_send_link_address+0x1554/0x2bf0 [drm_display_helper] [ 66.777901] drm_dp_check_and_send_link_address+0x187/0x1f0 [drm_display_helper] [ 66.777909] drm_dp_mst_link_probe_work+0x2b8/0x410 [drm_display_helper] [ 66.777917] process_one_work+0x86b/0x1510 [ 66.777919] worker_thread+0x5c0/0xfa0 [ 66.777922] kthread+0x3a2/0x840 [ 66.777925] ret_from_fork+0x40/0x90 [ 66.777927] ret_from_fork_asm+0x11/0x20
[ 66.777932] Freed by task 1713: [ 66.777935] kasan_save_stack+0x39/0x60 [ 66.777938] kasan_save_track+0x14/0x40 [ 66.777940] kasan_save_free_info+0x3b/0x60 [ 66.777944] __kasan_slab_free+0x52/0x70 [ 66.777946] kfree+0x13f/0x4b0 [ 66.777949] dm_dp_mst_connector_destroy+0xfa/0x150 [amdgpu] [ 66.778179] drm_connector_free+0x7d/0xb0 [ 66.778184] drm_mode_object_put.part.0+0xee/0x160 [ 66.778188] drm_mode_object_put+0x37/0x50 [ 66.778191] drm_atomic_state_default_clear+0x220/0xd60 [ 66.778194] __drm_atomic_state_free+0x16e/0x2a0 [ 66.778197] drm_mode_atomic_ioctl+0x15ed/0x2ba0 [ 66.778200] drm_ioctl_kernel+0x17a/0x310 [ 66.778203] drm_ioctl+0x584/0xd10 [ 66.778206] amdgpu_drm_ioctl+0xd2/0x1c0 [amdgpu] [ 66.778375] __x64_sys_ioctl+0x139/0x1a0 [ 66.778378] x64_sys_call+0xee7/0xfb0 [ 66.778381] ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | May 28, 2025 | May 20, 2025 |
| Suse | — | Upgrade kernel-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade cluster-md-kmp-64kbUpgrade dtb-appleUpgrade dtb-socionextUpgrade kernel-debugUpgrade kernel-rt_debug-develUpgrade kernel-azure-optionalUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade dtb-armUpgrade dtb-amdUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-default-develUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade dtb-amazonUpgrade kernel-rt-develUpgrade dtb-renesasUpgrade kernel-default-optionalUpgrade kernel-docsUpgrade kernel-azureUpgrade reiserfs-kmp-rtUpgrade dtb-mediatekUpgrade dtb-sprdUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-symsUpgrade dtb-caviumUpgrade kernel-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade kernel-azure-develUpgrade kernel-kvmsmall-develUpgrade kernel-source-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade kernel-sourceUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-default-livepatchUpgrade dtb-apmUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade dtb-marvellUpgrade dtb-exynosUpgrade kernel-default-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-obs-buildUpgrade dtb-amlogicUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-default | Dec 5, 2025 | Jun 16, 2025 |
| Ubuntu | — | Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-aws-fipsUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.14.0-1010-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.14.0-24-genericUpgrade linux-image-6.14.0-1007-oemUpgrade linux-image-6.14.0-1009-raspiUpgrade linux-image-fips-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-genericUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-ibmUpgrade linux-image-ibm-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.14.0-1009-aws-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-gkeopUpgrade linux-image-virtualUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-aws-6.8Upgrade linux-image-gkeop-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64kUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-azure-6.14Upgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-generic-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.14.0-1009-oracleUpgrade linux-image-oem-6.14Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.14.0-24-generic-64kUpgrade linux-image-nvidiaUpgrade linux-image-fipsUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-xilinxUpgrade linux-image-6.14.0-1011-gcp-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-xilinx-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.14.0-1011-gcpUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-raspi-6.14Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-gkeUpgrade linux-image-generic-6.14Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-virtual-6.14Upgrade linux-image-kvmUpgrade linux-image-azureUpgrade linux-image-6.14.0-1009-oracle-64kUpgrade linux-image-raspiUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gke-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.14.0-1009-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-gke-64kUpgrade linux-image-gcp-6.14Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-6.14Upgrade linux-image-oem-24.04cUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-gke-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-6.14.0-1006-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-aws-64kUpgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1030-gkeop | Jun 26, 2025 | May 20, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 8, 2025 | May 20, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub