CVE-2025-38098 (GCVE-0-2025-38098)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:13 – Updated: 2026-08-05 11:59
VLAI
Title
drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink Don't try to operate on a drm_wb_connector as an amdgpu_dm_connector. While dereferencing aconnector->base will "work" it's wrong and might lead to unknown bad things. Just... don't.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < b14e726d57f61085485f107a6203c50a09695abd (git)
Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < 18ca68f7c657721583a75cab01f0d0d2ec63a6c9 (git)
Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < cbf4890c6f28fb1ad733e14613fbd33c2004bced (git)
Affected: 0fe85301b95077ac4fa4a91909d38b7341e81187 (git)
Affected: 6.7.2 , < 6.8 (semver)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.31 , ≤ 6.12.* (semver)
Unaffected: 6.14.9 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b14e726d57f61085485f107a6203c50a09695abd",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "18ca68f7c657721583a75cab01f0d0d2ec63a6c9",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "cbf4890c6f28fb1ad733e14613fbd33c2004bced",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0fe85301b95077ac4fa4a91909d38b7341e81187",
              "versionType": "git"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink\n\nDon\u0027t try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector-\u003ebase will \"work\" it\u0027s wrong and\nmight lead to unknown bad things. Just... don\u0027t."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through DRM_IOCTL_MODE_ATOMIC on the local /dev/dri/cardN node of an AMD GPU. There is no network or adjacent-network path to amdgpu_dm_atomic_check().\nAC:L - A single deterministic atomic ioctl (even DRM_MODE_ATOMIC_TEST_ONLY) that attaches the writeback connector to a CRTC triggers the confused dereference on the first iteration; there is no race and no memory-layout dependency, and DWB/writeback connectors are present by default on all DCN3.0+ (RDNA2 and newer) hardware.\nPR:L - The attacker needs only to open the card node and hold DRM master, which the logged-in unprivileged seat owner obtains via logind device ACLs or `video` group membership (and any process opening the node on a free VT becomes master automatically). No root, and no capability in the init namespace, is required.\nUI:N - The attacker performs the atomic commit entirely from its own process; no victim action, display hotplug, or administrator step is needed.\nS:U - The confused pointer is dereferenced in kernel context on behalf of the calling process, and the damage is confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On 6.8\u20136.13 (including 6.12 LTS) the confused `dc_link` is a live kernel heap pointer (`drm_encoder.name`), and the driver reads ~1.2 KB past that small allocation into neighbouring slab objects \u2014 an unbounded out-of-bounds kernel read, whose result is observable through the resulting bpc_limit/mode-validation outcome returned by the atomic ioctl.\nI:H - This is a type confusion (CWE-843) in which the kernel operates on a `drm_writeback_connector` through an incompatible `amdgpu_dm_connector` view and dereferences a pointer synthesized from foreign struct fields; on 6.14+ that pointer lands in the user-address range, so on hardware without SMAP/PAN the attacker maps a fully attacker-controlled fake `struct dc_link` and steers kernel mode-validation state. Scored H per the conservative treatment of type confusion, though I found no direct write through the confused pointer.\nA:H - On 6.14/6.15 the wild pointer (~0x0000000N00000005) is dereferenced from kernel mode, producing an immediate SMAP/PAN page fault and kernel oops; on earlier branches the far out-of-bounds read is a KASAN-reportable slab overflow that can also fault. The crash is triggerable repeatedly by an unprivileged local user with a single ioctl."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:30.949Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced"
        }
      ],
      "title": "drm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38098",
    "datePublished": "2025-07-03T08:13:58.603Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-08-05T11:59:30.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38098",
      "date": "2026-08-13",
      "epss": "0.00167",
      "percentile": "0.06361"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:29:22.000Z",
      "cve": "CVE-2025-38098",
      "id": "msrc_CVE-2025-38098",
      "initial_release_date": "2025-07-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-38098.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38098\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-07-03T09:15:23.173\",\"lastModified\":\"2026-07-30T06:22:50.703\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink\\n\\nDon\u0027t try to operate on a drm_wb_connector as an amdgpu_dm_connector.\\nWhile dereferencing aconnector-\u003ebase will \\\"work\\\" it\u0027s wrong and\\nmight lead to unknown bad things. Just... don\u0027t.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: No trate el conector wb como f\u00edsico en create_validate_stream_for_sink. No intente operar en un drm_wb_connector como un amdgpu_dm_connector. Aunque desreferenciar aconnector-\u0026gt;base funciona, es incorrecto y podr\u00eda provocar problemas desconocidos. Simplemente... no lo haga.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c\",\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h\",\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dbf5d3d02987faa0eec3710dd687cd912362d7b5\",\"lessThan\":\"b14e726d57f61085485f107a6203c50a09695abd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dbf5d3d02987faa0eec3710dd687cd912362d7b5\",\"lessThan\":\"18ca68f7c657721583a75cab01f0d0d2ec63a6c9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"dbf5d3d02987faa0eec3710dd687cd912362d7b5\",\"lessThan\":\"cbf4890c6f28fb1ad733e14613fbd33c2004bced\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0fe85301b95077ac4fa4a91909d38b7341e81187\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.7.2\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c\",\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h\",\"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.31\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.9\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.2\",\"versionEndExcluding\":\"6.12.31\",\"matchCriteriaId\":\"E57E8C0A-CFAB-49DC-85D6-418A3F199253\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.9\",\"matchCriteriaId\":\"A9B72DD1-715C-4101-A720-1C8D70044C06\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:21:30+00:00",
      "cve": "CVE-2025-38098",
      "id": "CVE-2025-38098",
      "initial_release_date": "2025-07-03T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38098.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:43:45Z",
      "cve": "CVE-2025-38098",
      "id": "CVE-2025-38098",
      "initial_release_date": "2025-07-03T23:24:02Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "410",
      "product_status:known_not_affected": "305",
      "product_status:recommended": "508",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-38098",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-38098.json",
      "version": "43"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.