Vulnerability-Lookup

FKIE_CVE-2025-38098

Vulnerability from fkie_nvd - Published: 2025-07-03 09:15 - Updated: 2026-07-30 06:22

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink Don't try to operate on a drm_wb_connector as an amdgpu_dm_connector. While dereferencing aconnector->base will "work" it's wrong and might lead to unknown bad things. Just... don't.

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced	Patch

Impacted products

	Vendor	Product	Version
	linux	linux_kernel	*
	linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b14e726d57f61085485f107a6203c50a09695abd",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "18ca68f7c657721583a75cab01f0d0d2ec63a6c9",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "cbf4890c6f28fb1ad733e14613fbd33c2004bced",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0fe85301b95077ac4fa4a91909d38b7341e81187",
              "versionType": "git"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E57E8C0A-CFAB-49DC-85D6-418A3F199253",
              "versionEndExcluding": "6.12.31",
              "versionStartIncluding": "6.7.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06",
              "versionEndExcluding": "6.14.9",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink\n\nDon\u0027t try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector-\u003ebase will \"work\" it\u0027s wrong and\nmight lead to unknown bad things. Just... don\u0027t."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: No trate el conector wb como f\u00edsico en create_validate_stream_for_sink. No intente operar en un drm_wb_connector como un amdgpu_dm_connector. Aunque desreferenciar aconnector-\u0026gt;base funciona, es incorrecto y podr\u00eda provocar problemas desconocidos. Simplemente... no lo haga."
    }
  ],
  "id": "CVE-2025-38098",
  "lastModified": "2026-07-30T06:22:50.703",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-07-03T09:15:23.173",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-38098 (GCVE-0-2025-38098)

Vulnerability from cvelistv5 – Published: 2025-07-03 08:13 – Updated: 2026-08-05 11:59

Title

drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

3 references

URL	Tags
https://git.kernel.org/stable/c/b14e726d57f610854…
https://git.kernel.org/stable/c/18ca68f7c65772158…
https://git.kernel.org/stable/c/cbf4890c6f28fb1ad…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < b14e726d57f61085485f107a6203c50a09695abd (git) Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < 18ca68f7c657721583a75cab01f0d0d2ec63a6c9 (git) Affected: dbf5d3d02987faa0eec3710dd687cd912362d7b5 , < cbf4890c6f28fb1ad733e14613fbd33c2004bced (git) Affected: 0fe85301b95077ac4fa4a91909d38b7341e81187 (git) Affected: 6.7.2 , < 6.8 (semver)
Linux	Linux	Affected: 6.8 Unaffected: 0 , < 6.8 (semver) Unaffected: 6.12.31 , ≤ 6.12.* (semver) Unaffected: 6.14.9 , ≤ 6.14.* (semver) Unaffected: 6.15 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b14e726d57f61085485f107a6203c50a09695abd",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "18ca68f7c657721583a75cab01f0d0d2ec63a6c9",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "lessThan": "cbf4890c6f28fb1ad733e14613fbd33c2004bced",
              "status": "affected",
              "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0fe85301b95077ac4fa4a91909d38b7341e81187",
              "versionType": "git"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h",
            "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.31",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink\n\nDon\u0027t try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector-\u003ebase will \"work\" it\u0027s wrong and\nmight lead to unknown bad things. Just... don\u0027t."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through DRM_IOCTL_MODE_ATOMIC on the local /dev/dri/cardN node of an AMD GPU. There is no network or adjacent-network path to amdgpu_dm_atomic_check().\nAC:L - A single deterministic atomic ioctl (even DRM_MODE_ATOMIC_TEST_ONLY) that attaches the writeback connector to a CRTC triggers the confused dereference on the first iteration; there is no race and no memory-layout dependency, and DWB/writeback connectors are present by default on all DCN3.0+ (RDNA2 and newer) hardware.\nPR:L - The attacker needs only to open the card node and hold DRM master, which the logged-in unprivileged seat owner obtains via logind device ACLs or `video` group membership (and any process opening the node on a free VT becomes master automatically). No root, and no capability in the init namespace, is required.\nUI:N - The attacker performs the atomic commit entirely from its own process; no victim action, display hotplug, or administrator step is needed.\nS:U - The confused pointer is dereferenced in kernel context on behalf of the calling process, and the damage is confined to the kernel\u0027s own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On 6.8\u20136.13 (including 6.12 LTS) the confused `dc_link` is a live kernel heap pointer (`drm_encoder.name`), and the driver reads ~1.2 KB past that small allocation into neighbouring slab objects \u2014 an unbounded out-of-bounds kernel read, whose result is observable through the resulting bpc_limit/mode-validation outcome returned by the atomic ioctl.\nI:H - This is a type confusion (CWE-843) in which the kernel operates on a `drm_writeback_connector` through an incompatible `amdgpu_dm_connector` view and dereferences a pointer synthesized from foreign struct fields; on 6.14+ that pointer lands in the user-address range, so on hardware without SMAP/PAN the attacker maps a fully attacker-controlled fake `struct dc_link` and steers kernel mode-validation state. Scored H per the conservative treatment of type confusion, though I found no direct write through the confused pointer.\nA:H - On 6.14/6.15 the wild pointer (~0x0000000N00000005) is dereferenced from kernel mode, producing an immediate SMAP/PAN page fault and kernel oops; on earlier branches the far out-of-bounds read is a KASAN-reportable slab overflow that can also fault. The crash is triggerable repeatedly by an unprivileged local user with a single ioctl."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:59:30.949Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced"
        }
      ],
      "title": "drm/amd/display: Don\u0027t treat wb connector as physical in create_validate_stream_for_sink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38098",
    "datePublished": "2025-07-03T08:13:58.603Z",
    "dateReserved": "2025-04-16T04:51:23.985Z",
    "dateUpdated": "2026-08-05T11:59:30.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2025-38098

CVE-2025-38098 (GCVE-0-2025-38098)

Tags

Sightings

Nomenclature

Related by attack behaviour