In the Linux kernel, the following vulnerability has been resolved:
drm/gem: Acquire references on GEM handles for framebuffers
A GEM handle can be released while the GEM buffer object is attached to a DRM framebuffer. This leads to the release of the dma-buf backing the buffer object, if any. [1] Trying to use the framebuffer in further mode-setting operations leads to a segmentation fault. Most easily happens with driver that use shadow planes for vmap-ing the dma-buf during a page flip. An example is shown below.
[ 156.791968] ------------[ cut here ]------------ [ 156.796830] WARNING: CPU: 2 PID: 2255 at drivers/dma-buf/dma-buf.c:1527 dma_buf_vmap+0x224/0x430 [...] [ 156.942028] RIP: 0010:dma_buf_vmap+0x224/0x430 [ 157.043420] Call Trace: [ 157.045898] <TASK> [ 157.048030] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.052436] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.056836] ? show_trace_log_lvl+0x1af/0x2c0 [ 157.061253] ? drm_gem_shmem_vmap+0x74/0x710 [ 157.065567] ? dma_buf_vmap+0x224/0x430 [ 157.069446] ? __warn.cold+0x58/0xe4 [ 157.073061] ? dma_buf_vmap+0x224/0x430 [ 157.077111] ? report_bug+0x1dd/0x390 [ 157.080842] ? handle_bug+0x5e/0xa0 [ 157.084389] ? exc_invalid_op+0x14/0x50 [ 157.088291] ? asm_exc_invalid_op+0x16/0x20 [ 157.092548] ? dma_buf_vmap+0x224/0x430 [ 157.096663] ? dma_resv_get_singleton+0x6d/0x230 [ 157.101341] ? __pfx_dma_buf_vmap+0x10/0x10 [ 157.105588] ? __pfx_dma_resv_get_singleton+0x10/0x10 [ 157.110697] drm_gem_shmem_vmap+0x74/0x710 [ 157.114866] drm_gem_vmap+0xa9/0x1b0 [ 157.118763] drm_gem_vmap_unlocked+0x46/0xa0 [ 157.123086] drm_gem_fb_vmap+0xab/0x300 [ 157.126979] drm_atomic_helper_prepare_planes.part.0+0x487/0xb10 [ 157.133032] ? lockdep_init_map_type+0x19d/0x880 [ 157.137701] drm_atomic_helper_commit+0x13d/0x2e0 [ 157.142671] ? drm_atomic_nonblocking_commit+0xa0/0x180 [ 157.147988] drm_mode_atomic_ioctl+0x766/0xe40 [...] [ 157.346424] ---[ end trace 0000000000000000 ]---
Acquiring GEM handles for the framebuffer's GEM buffer objects prevents this from happening. The framebuffer's cleanup later puts the handle references.
Commit 1a148af06000 ("drm/gem-shmem: Use dma_buf from GEM object instance") triggers the segmentation fault easily by using the dma-buf field more widely. The underlying issue with reference counting has been present before.
v2: - acquire the handle instead of the BO (Christian) - fix comment style (Christian) - drop the Fixes tag (Christian) - rename err_ gotos - add missing Link tag
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-64kUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-64kUpgrade kernel-rt-64k-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-kvmUpgrade kernel-toolsUpgrade kernel-rt-modules-coreUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debugUpgrade kernel-rt-64k-modules-extraUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-modulesUpgrade kernelUpgrade kernel-rt-64k-develUpgrade kernel-rtUpgrade kernel-64k-modules-extraUpgrade kernel-rt-develUpgrade rvUpgrade kernel-rt-64k-modules-coreUpgrade kernel-64k-modulesUpgrade kernel-headersUpgrade kernel-debug-modules-coreUpgrade kernel-rt-modulesUpgrade perfUpgrade python3-perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-coreUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade libperfUpgrade kernel-64k-develUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-develUpgrade rtlaUpgrade kernel-debug-devel-matchedUpgrade kernel-modulesUpgrade kernel-devel-matchedUpgrade kernel-64k-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-develUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debugUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel | Sep 17, 2025 | Sep 15, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade kernel-livepatch-6.12.40-63.114Upgrade perf6.12Upgrade kernel6.12-libbpf-staticUpgrade kernel6.12-tools-develUpgrade kernel6.12-toolsUpgrade kernel6.12-libbpfUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12-debuginfo-common-aarch64Upgrade bpftool6.12Upgrade python3-perf6.12Upgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-develUpgrade kernel6.12-libbpf-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12Upgrade perf6.12-debuginfo | Sep 16, 2025 | Jul 25, 2025 |
| Debian | — | Upgrade linux | Jul 28, 2025 | Jul 28, 2025 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perf | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-tools | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libs | Oct 24, 2025 | Oct 10, 2025 |
| Oracle_linux | — | Upgrade kernel | Sep 12, 2025 | Jul 25, 2025 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Jul 31, 2025 | Jul 25, 2025 |
| Rocky_linux | — | Upgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade kernel-develUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade rtlaUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade libperf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-debug-debuginfoUpgrade python3-perfUpgrade kernel-rt-kvmUpgrade kernelUpgrade perfUpgrade kernel-debug-develUpgrade kernel-debug-modules-coreUpgrade rvUpgrade perf-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade libperfUpgrade kernel-tools-debuginfoUpgrade kernel-rtUpgrade kernel-modulesUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-uki-virt-addonsUpgrade kernel-debug-debuginfoUpgrade kernel-uki-virtUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extra | Feb 5, 2026 | Oct 10, 2025 |
| Suse | — | Upgrade kernel-symsUpgrade ocfs2-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azure-develUpgrade dlm-kmp-defaultUpgrade kernel-develUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-macrosUpgrade kselftests-kmp-rtUpgrade dtb-rockchipUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade dtb-amlogicUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade kernel-64kb-extraUpgrade kernel-default-extraUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade kernel-obs-qaUpgrade dtb-qcomUpgrade kernel-rt-livepatchUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade dtb-sprdUpgrade cluster-md-kmp-defaultUpgrade dtb-apmUpgrade kernel-rtUpgrade kernel-default-optionalUpgrade kernel-rt-extraUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade dtb-alteraUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade dtb-amdUpgrade kernel-default-manUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-marvellUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-sourceUpgrade dtb-amazonUpgrade dlm-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-hisiliconUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade dtb-socionextUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-kvmsmallUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-develUpgrade kernel-debugUpgrade kselftests-kmp-64kbUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade dtb-caviumUpgrade kernel-rt_debugUpgrade kernel-rt-livepatch-develUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade cluster-md-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-devel-azure | Dec 5, 2025 | Sep 12, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-22.04aUpgrade linux-image-generic-64k-6.14Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-genericUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.14.0-36-generic-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-nvidiaUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.14.0-1020-gcpUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-6.14Upgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-6.14Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.14.0-1017-awsUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-gkeopUpgrade linux-image-gke-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-virtualUpgrade linux-image-azure-6.14Upgrade linux-image-aws-fipsUpgrade linux-image-fipsUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.14.0-1017-aws-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-azure-fipsUpgrade linux-image-virtual-6.14Upgrade linux-image-realtime-6.14Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.14.0-1016-realtimeUpgrade linux-image-oem-24.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-raspi-6.14Upgrade linux-image-kvmUpgrade linux-image-raspiUpgrade linux-image-6.14.0-1017-oracle-64kUpgrade linux-image-ibm-classicUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-xilinxUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-generic-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gcp-64k-6.14Upgrade linux-image-ibm-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.14.0-1017-oracleUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-awsUpgrade linux-image-gcpUpgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.14.0-1016-oemUpgrade linux-image-raspi-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-6.14Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-raspi-realtimeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-fips-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-6.14.0-36-genericUpgrade linux-image-6.14.0-1020-gcp-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-aws-64k-6.8Upgrade linux-image-realtimeUpgrade linux-image-virtual-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-oracle-6.8Upgrade linux-image-6.14.0-1018-raspiUpgrade linux-image-oem-22.04bUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.14.0-1017-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-nvidia-hwe-22.04 | Jul 31, 2025 | Jul 25, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub