GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40354 (GCVE-0-2025-40354)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:30 – Updated: 2026-08-05 12:09
VLAI
Title
drm/amd/display: increase max link count and fix link->enc NULL pointer access
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: increase max link count and fix link->enc NULL pointer access [why] 1.) dc->links[MAX_LINKS] array size smaller than actual requested. max_connector + max_dpia + 4 virtual = 14. increase from 12 to 14. 2.) hw_init() access null LINK_ENC for dpia non display_endpoint. (cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < f28092be4e12b7df9e4f415d25bf0d767bc2d9ed (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < a3fc0d36cfb927f8986b83bf5fba47dbedad3c63 (git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < bec947cbe9a65783adb475a5fb47980d7b4f4796 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.15
Unaffected: 0 , < 4.15 (semver)
Unaffected: 6.12.56 , ≤ 6.12.* (semver)
Unaffected: 6.17.6 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c",
            "drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f28092be4e12b7df9e4f415d25bf0d767bc2d9ed",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "a3fc0d36cfb927f8986b83bf5fba47dbedad3c63",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            },
            {
              "lessThan": "bec947cbe9a65783adb475a5fb47980d7b4f4796",
              "status": "affected",
              "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c",
            "drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.56",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.56",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.6",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: increase max link count and fix link-\u003eenc NULL pointer access\n\n[why]\n1.) dc-\u003elinks[MAX_LINKS] array size smaller than actual requested.\nmax_connector + max_dpia + 4 virtual = 14.\nincrease from 12 to 14.\n\n2.) hw_init() access null LINK_ENC for dpia non display_endpoint.\n\n(cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The defect is in the amdgpu DC display driver\u0027s hardware-init path, reached through local driver probe and suspend/resume (including runtime-PM resume driven by opening /dev/dri/renderD*). There is no network-facing component.\nAC:L - Both the unbounded `dc-\u003elinks[]` append in create_links() and the NULL `link-\u003elink_enc` dereference for DPIA endpoints are deterministic on affected DCN4x configurations \u2014 no race to win and no memory layout beyond the attacker\u0027s influence.\nPR:L - The vulnerable init_hw path is re-entered on every runtime-PM/system resume via dm_resume() -\u003e dc_set_power_state(D0), which an unprivileged local user holding an ordinary DRM/render node handle can drive repeatedly; no root or CAP_SYS_ADMIN is required.\nUI:N - No victim action is needed \u2014 the corrupting create_links() loop runs at driver init and the NULL dereference is hit automatically on each hardware init/resume cycle.\nS:U - The out-of-bounds write and NULL dereference stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Overflowing dc-\u003elinks[] overwrites the adjacent `struct link_service *link_srv`, `current_state`, and `res_pool` pointers in struct dc, so subsequent dc-\u003elink_srv-\u003e...() dispatches read from an attacker-influenceable heap object, yielding pointer confusion and arbitrary kernel-memory read primitives.\nI:H - This is an out-of-bounds write of pointer values past a fixed array directly onto a function-pointer-table pointer (link_srv), giving a realistic indirect-call hijack and arbitrary write path rather than a bounded corruption.\nA:H - The unfixed DPIA path dereferences a NULL link-\u003elink_enc in dcn401_init_hw(), producing a kernel oops on every hardware init/resume, and the adjacent-field corruption reliably panics the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:51.348Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f28092be4e12b7df9e4f415d25bf0d767bc2d9ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3fc0d36cfb927f8986b83bf5fba47dbedad3c63"
        },
        {
          "url": "https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"
        }
      ],
      "title": "drm/amd/display: increase max link count and fix link-\u003eenc NULL pointer access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40354",
    "datePublished": "2025-12-16T13:30:27.082Z",
    "dateReserved": "2025-04-16T07:20:57.187Z",
    "dateUpdated": "2026-08-05T12:09:51.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40354",
      "date": "2026-09-19",
      "epss": "0.00151",
      "percentile": "0.04674"
    },
    "microsoft_vex": {
      "current_release_date": "2026-01-13T01:36:14.000Z",
      "cve": "CVE-2025-40354",
      "id": "msrc_CVE-2025-40354",
      "initial_release_date": "2025-12-02T00:00:00.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drm/amd/display: increase max link count and fix link-\u003eenc NULL pointer access",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-40354.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c",
                  "drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f28092be4e12b7df9e4f415d25bf0d767bc2d9ed",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a3fc0d36cfb927f8986b83bf5fba47dbedad3c63",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bec947cbe9a65783adb475a5fb47980d7b4f4796",
                    "status": "affected",
                    "version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c",
                  "drivers/gpu/drm/amd/display/dc/inc/hw/hw_shared.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.15"
                  },
                  {
                    "lessThan": "4.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.56",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.17.*",
                    "status": "unaffected",
                    "version": "6.17.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: increase max link count and fix link-\u003eenc NULL pointer access\n\n[why]\n1.) dc-\u003elinks[MAX_LINKS] array size smaller than actual requested.\nmax_connector + max_dpia + 4 virtual = 14.\nincrease from 12 to 14.\n\n2.) hw_init() access null LINK_ENC for dpia non display_endpoint.\n\n(cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45)"
          }
        ],
        "id": "CVE-2025-40354",
        "lastModified": "2026-07-30T06:24:31.017",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-16T14:15:47.310",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a3fc0d36cfb927f8986b83bf5fba47dbedad3c63"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f28092be4e12b7df9e4f415d25bf0d767bc2d9ed"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:39:15+00:00",
      "cve": "CVE-2025-40354",
      "id": "CVE-2025-40354",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation in AMD display driver",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40354.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.