CVE-2025-40148 (GCVE-0-2025-40148)
Vulnerability from cvelistv5
Published
2025-11-12 10:23
Modified
2025-11-12 10:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions
The function dc_stream_set_cursor_attributes() currently dereferences
the `stream` pointer and nested members `stream->ctx->dc->current_state`
without checking for NULL.
All callers of these functions, such as in
`dcn30_apply_idle_power_optimizations()` and
`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks
before calling these functions.
Fixes below:
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()
error: we previously assumed 'stream' could be null (see line 334)
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
327 bool dc_stream_program_cursor_attributes(
328 struct dc_stream_state *stream,
329 const struct dc_cursor_attributes *attributes)
330 {
331 struct dc *dc;
332 bool reset_idle_optimizations = false;
333
334 dc = stream ? stream->ctx->dc : NULL;
^^^^^^
The old code assumed stream could be NULL.
335
--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {
^^^^^^
The refactor added an unchecked dereference.
drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c
313 bool dc_stream_set_cursor_attributes(
314 struct dc_stream_state *stream,
315 const struct dc_cursor_attributes *attributes)
316 {
317 bool result = false;
318
319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.
This function used to check for if stream as NULL and return false at
the start. Probably we should add that back.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc_stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01e793e7d4d402c473f1a61ca5824f086693be65",
"status": "affected",
"version": "4465dd0e41e8223a46a41ce4fcdfc55fabd319d8",
"versionType": "git"
},
{
"lessThan": "bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11",
"status": "affected",
"version": "4465dd0e41e8223a46a41ce4fcdfc55fabd319d8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc_stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18-rc1",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions\n\nThe function dc_stream_set_cursor_attributes() currently dereferences\nthe `stream` pointer and nested members `stream-\u003ectx-\u003edc-\u003ecurrent_state`\nwithout checking for NULL.\n\nAll callers of these functions, such as in\n`dcn30_apply_idle_power_optimizations()` and\n`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks\nbefore calling these functions.\n\nFixes below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()\nerror: we previously assumed \u0027stream\u0027 could be null (see line 334)\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 327 bool dc_stream_program_cursor_attributes(\n 328 struct dc_stream_state *stream,\n 329 const struct dc_cursor_attributes *attributes)\n 330 {\n 331 struct dc *dc;\n 332 bool reset_idle_optimizations = false;\n 333\n 334 dc = stream ? stream-\u003ectx-\u003edc : NULL;\n ^^^^^^\nThe old code assumed stream could be NULL.\n\n 335\n--\u003e 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {\n ^^^^^^\nThe refactor added an unchecked dereference.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 313 bool dc_stream_set_cursor_attributes(\n 314 struct dc_stream_state *stream,\n 315 const struct dc_cursor_attributes *attributes)\n 316 {\n 317 bool result = false;\n 318\n 319 if (dc_stream_check_cursor_attributes(stream, stream-\u003ectx-\u003edc-\u003ecurrent_state, attributes)) {\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.\nThis function used to check for if stream as NULL and return false at\nthe start. Probably we should add that back."
}
],
"providerMetadata": {
"dateUpdated": "2025-11-12T10:23:26.841Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01e793e7d4d402c473f1a61ca5824f086693be65"
},
{
"url": "https://git.kernel.org/stable/c/bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11"
}
],
"title": "drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40148",
"datePublished": "2025-11-12T10:23:26.841Z",
"dateReserved": "2025-04-16T07:20:57.175Z",
"dateUpdated": "2025-11-12T10:23:26.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-40148\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T11:15:44.700\",\"lastModified\":\"2025-11-12T16:19:12.850\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions\\n\\nThe function dc_stream_set_cursor_attributes() currently dereferences\\nthe `stream` pointer and nested members `stream-\u003ectx-\u003edc-\u003ecurrent_state`\\nwithout checking for NULL.\\n\\nAll callers of these functions, such as in\\n`dcn30_apply_idle_power_optimizations()` and\\n`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks\\nbefore calling these functions.\\n\\nFixes below:\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()\\nerror: we previously assumed \u0027stream\u0027 could be null (see line 334)\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\\n 327 bool dc_stream_program_cursor_attributes(\\n 328 struct dc_stream_state *stream,\\n 329 const struct dc_cursor_attributes *attributes)\\n 330 {\\n 331 struct dc *dc;\\n 332 bool reset_idle_optimizations = false;\\n 333\\n 334 dc = stream ? stream-\u003ectx-\u003edc : NULL;\\n ^^^^^^\\nThe old code assumed stream could be NULL.\\n\\n 335\\n--\u003e 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {\\n ^^^^^^\\nThe refactor added an unchecked dereference.\\n\\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\\n 313 bool dc_stream_set_cursor_attributes(\\n 314 struct dc_stream_state *stream,\\n 315 const struct dc_cursor_attributes *attributes)\\n 316 {\\n 317 bool result = false;\\n 318\\n 319 if (dc_stream_check_cursor_attributes(stream, stream-\u003ectx-\u003edc-\u003ecurrent_state, attributes)) {\\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.\\nThis function used to check for if stream as NULL and return false at\\nthe start. Probably we should add that back.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01e793e7d4d402c473f1a61ca5824f086693be65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…