FKIE_CVE-2025-40073

Vulnerability from fkie_nvd - Published: 2025-10-28 12:15 - Updated: 2026-10-19 21:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current plane is not associated with any SSPP yet. Null pointer is referenced when validating the SSPP of current plane. Skip SSPP validation for current plane. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: SM8650 EV1 rev1 4slam 2et (DT) pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : dpu_plane_is_multirect_capable+0x68/0x90 lr : dpu_assign_plane_resources+0x288/0x410 sp : ffff800093dcb770 x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 x23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080 x20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff x17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200 x14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000 x11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950 x8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438 x2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000 Call trace: dpu_plane_is_multirect_capable+0x68/0x90 (P) dpu_crtc_atomic_check+0x5bc/0x650 drm_atomic_helper_check_planes+0x13c/0x220 drm_atomic_helper_check+0x58/0xb8 msm_atomic_check+0xd8/0xf0 drm_atomic_check_only+0x4a8/0x968 drm_atomic_commit+0x50/0xd8 drm_atomic_helper_update_plane+0x140/0x188 __setplane_atomic+0xfc/0x148 drm_mode_setplane+0x164/0x378 drm_ioctl_kernel+0xc0/0x140 drm_ioctl+0x20c/0x500 __arm64_sys_ioctl+0xbc/0xf8 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x48/0xf8 do_el0_svc+0x28/0x40 el0_svc+0x30/0xd0 el0t_64_sync_handler+0x144/0x168 el0t_64_sync+0x198/0x1a0 Code: b9402021 370fffc1 f9401441 3707ff81 (f94010a1) ---[ end trace 0000000000000000 ]--- Patchwork: https://patchwork.freedesktop.org/patch/669224/
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6fc616723bb5fd4289d7422fa013da062b44ae55
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f1dbb3eedb7db4cad45d2619edb1cce6041f79e3
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f1dbb3eedb7db4cad45d2619edb1cce6041f79e3",
              "status": "affected",
              "version": "3ed12a3664b362e3462cca61d41f9a9460c9e260",
              "versionType": "git"
            },
            {
              "lessThan": "6fc616723bb5fd4289d7422fa013da062b44ae55",
              "status": "affected",
              "version": "3ed12a3664b362e3462cca61d41f9a9460c9e260",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: Do not validate SSPP when it is not ready\n\nCurrent code will validate current plane and previous plane to\nconfirm they can share a SSPP with multi-rect mode. The SSPP\nis already allocated for previous plane, while current plane\nis not associated with any SSPP yet. Null pointer is referenced\nwhen validating the SSPP of current plane. Skip SSPP validation\nfor current plane.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000020\nMem abort info:\n  ESR = 0x0000000096000004\n  EC = 0x25: DABT (current EL), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x04: level 0 translation fault\nData abort info:\n  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n  CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\nuser pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000\n[0000000000000020] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1]  SMP\nModules linked in:\nCPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S                  6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT\nTainted: [S]=CPU_OUT_OF_SPEC\nHardware name: SM8650 EV1 rev1 4slam 2et (DT)\npstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : dpu_plane_is_multirect_capable+0x68/0x90\nlr : dpu_assign_plane_resources+0x288/0x410\nsp : ffff800093dcb770\nx29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000\nx26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800\nx23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080\nx20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff\nx17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200\nx14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000\nx11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950\nx8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000\nx5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438\nx2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000\nCall trace:\n dpu_plane_is_multirect_capable+0x68/0x90 (P)\n dpu_crtc_atomic_check+0x5bc/0x650\n drm_atomic_helper_check_planes+0x13c/0x220\n drm_atomic_helper_check+0x58/0xb8\n msm_atomic_check+0xd8/0xf0\n drm_atomic_check_only+0x4a8/0x968\n drm_atomic_commit+0x50/0xd8\n drm_atomic_helper_update_plane+0x140/0x188\n __setplane_atomic+0xfc/0x148\n drm_mode_setplane+0x164/0x378\n drm_ioctl_kernel+0xc0/0x140\n drm_ioctl+0x20c/0x500\n __arm64_sys_ioctl+0xbc/0xf8\n invoke_syscall+0x50/0x120\n el0_svc_common.constprop.0+0x48/0xf8\n do_el0_svc+0x28/0x40\n el0_svc+0x30/0xd0\n el0t_64_sync_handler+0x144/0x168\n el0t_64_sync+0x198/0x1a0\nCode: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)\n---[ end trace 0000000000000000 ]---\n\nPatchwork: https://patchwork.freedesktop.org/patch/669224/"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/msm: No validar SSPP cuando no est\u00e1 listo\n\nEl c\u00f3digo actual validar\u00e1 el plano actual y el plano anterior para confirmar que pueden compartir un SSPP con el modo multi-rect. El SSPP ya est\u00e1 asignado para el plano anterior, mientras que el plano actual a\u00fan no est\u00e1 asociado con ning\u00fan SSPP. Se hace referencia a un puntero nulo al validar el SSPP del plano actual. Omitir la validaci\u00f3n de SSPP para el plano actual.\n\nNo se puede manejar la desreferencia de puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000020\nInformaci\u00f3n de aborto de memoria:\n  ESR = 0x0000000096000004\n  EC = 0x25: DABT (EL actual), IL = 32 bits\n  SET = 0, FnV = 0\n  EA = 0, S1PTW = 0\n  FSC = 0x04: fallo de traducci\u00f3n de nivel 0\nInformaci\u00f3n de aborto de datos:\n  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n  CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\ntabla de p\u00e1ginas de usuario: p\u00e1ginas de 4k, VA de 48 bits, pgdp=0000000888ac3000\n[0000000000000020] pgd=0000000000000000, p4d=0000000000000000\nError interno: Oops: 0000000096000004 [#1] SMP\nM\u00f3dulos enlazados:\nCPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S                  6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT\nTainted: [S]=CPU_OUT_OF_SPEC\nNombre del hardware: SM8650 EV1 rev1 4slam 2et (DT)\npstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\npc : dpu_plane_is_multirect_capable+0x68/0x90\nlr : dpu_assign_plane_resources+0x288/0x410\nsp : ffff800093dcb770\nx29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000\nx26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800\nx23: ffff000810842680 x22: ffff0008013f1080 x21: ffff00080cc86080\nx20: ffff000806b463b0 x19: ffff00080cbf5a00 x18: 00000000ffffffff\nx17: 707a5f657a696c61 x16: 0000000000000003 x15: 0000000000002200\nx14: 00000000ffffffff x13: 00aaaaaa00aaaaaa x12: 0000000000000000\nx11: ffff000817c6e2b8 x10: 0000000000000000 x9 : ffff80008106a950\nx8 : ffff00080cbf48f4 x7 : 0000000000000000 x6 : 0000000000000000\nx5 : 0000000000000000 x4 : 0000000000000438 x3 : 0000000000000438\nx2 : ffff800082e245e0 x1 : 0000000000000008 x0 : 0000000000000000\nRastro de llamada:\n dpu_plane_is_multirect_capable+0x68/0x90 (P)\n dpu_crtc_atomic_check+0x5bc/0x650\n drm_atomic_helper_check_planes+0x13c/0x220\n drm_atomic_helper_check+0x58/0xb8\n msm_atomic_check+0xd8/0xf0\n drm_atomic_check_only+0x4a8/0x968\n drm_atomic_commit+0x50/0xd8\n drm_atomic_helper_update_plane+0x140/0x188\n __setplane_atomic+0xfc/0x148\n drm_mode_setplane+0x164/0x378\n drm_ioctl_kernel+0xc0/0x140\n drm_ioctl+0x20c/0x500\n __arm64_sys_ioctl+0xbc/0xf8\n invoke_syscall+0x50/0x120\n el0_svc_common.constprop.0+0x48/0xf8\n do_el0_svc+0x28/0x40\n el0_svc+0x30/0xd0\n el0t_64_sync_handler+0x144/0x168\n el0t_64_sync+0x198/0x1a0\nC\u00f3digo: b9402021 370fffc1 f9401441 3707ff81 (f94010a1)\n---[ fin del rastro 0000000000000000 ]---\n\nPatchwork: https://patchwork.freedesktop.org/patch/669224/"
    }
  ],
  "id": "CVE-2025-40073",
  "lastModified": "2026-10-19T21:10:00.160",
  "metrics": {},
  "published": "2025-10-28T12:15:41.830",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6fc616723bb5fd4289d7422fa013da062b44ae55"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f1dbb3eedb7db4cad45d2619edb1cce6041f79e3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.