In the Linux kernel, the following vulnerability has been resolved:
drm/gem: Acquire references on GEM handles for framebuffers
A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below.
[ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]---
Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references.
Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before.
v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debugUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade kernel-rt-modules-extraUpgrade kernelUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-cross-headersUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-debugUpgrade rvUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-rt-64k-develUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-kvmUpgrade kernel-64k-debug-coreUpgrade kernel-rtUpgrade kernel-tools-libs-develUpgrade kernel-64k-debugUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-develUpgrade perfUpgrade kernel-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-develUpgrade kernel-rt-coreUpgrade libperfUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-headersUpgrade kernel-debug-modules-coreUpgrade kernel-develUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-modules-extraUpgrade kernel-docUpgrade kernel-64k-debug-develUpgrade kernel-64k-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debug-devel-matched | Sep 17, 2025 | Sep 15, 2025 |
| Amazon_linux_2023 | — | Upgrade perf6.12-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-libbpf-develUpgrade python3-perf6.12Upgrade bpftool6.12Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade kernel-livepatch-6.12.40-63.114Upgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfoUpgrade kernel6.12-toolsUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-static | Sep 16, 2025 | Jul 25, 2025 |
| Debian | — | Upgrade linuxNo solution exists | Jul 28, 2025 | Jul 28, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-tools | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-tools | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel | Sep 12, 2025 | Jul 25, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 31, 2025 | Jul 25, 2025 |
| Rocky_linux | — | Upgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-debuginfoUpgrade rtlaUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debuginfoUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-rt-kvmUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-devel-matchedUpgrade python3-perfUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade libperf-debuginfoUpgrade kernel-debug-devel-matchedUpgrade kernelUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-debug-debuginfoUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade rvUpgrade libperfUpgrade kernel-tools-debuginfoUpgrade kernel-rtUpgrade kernel-debug-uki-virtUpgrade kernel-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-debug-develUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debugUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modules-coreUpgrade perf-debuginfoUpgrade kernel-coreUpgrade kernel-modules-coreUpgrade kernel-uki-virt-addons | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade kernel-syms-azureUpgrade dlm-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kernel-develUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade dtb-mediatekUpgrade dtb-rockchipUpgrade dtb-xilinxUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-rtUpgrade kernel-macrosUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade dtb-qcomUpgrade dtb-apmUpgrade kernel-rt-livepatchUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade dtb-amlogicUpgrade dtb-renesasUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade dtb-lgUpgrade dtb-hisiliconUpgrade dtb-broadcomUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade dlm-kmp-64kbUpgrade dtb-amazonUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade kernel-azure-optionalUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-sourceUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-64kbUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade gfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-socionextUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-develUpgrade dtb-appleUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-develUpgrade dtb-alteraUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-default-manUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade kernel-debug-develUpgrade kernel-azure-extraUpgrade kernel-source-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-rt_debugUpgrade gfs2-kmp-64kb | Dec 5, 2025 | Sep 12, 2025 |
| Ubuntu | — | Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-generic-64k-6.14Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gke-64kUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-oracle-6.14Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oem-22.04Upgrade linux-image-azure-6.14Upgrade linux-image-aws-fipsUpgrade linux-image-fipsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-azure-lts-24.04Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.14.0-1017-awsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-virtualUpgrade linux-image-oem-6.14Upgrade linux-image-nvidia-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-6.8Upgrade linux-image-generic-6.14Upgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.14.0-1016-oemUpgrade linux-image-raspi-6.8Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-raspiUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-kvmUpgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-virtual-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-virtual-6.14Upgrade linux-image-oem-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-azure-fips-6.8Upgrade linux-image-gcp-6.14Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-raspi-realtimeUpgrade linux-image-azure-fipsUpgrade linux-image-xilinx-6.8Upgrade linux-image-xilinxUpgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-6.14.0-1017-azureUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-oem-22.04dUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-gcp-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-intel-iotgUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-36-genericUpgrade linux-image-oem-22.04bUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-fips-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1023-xilinx | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub