CVE-2025-38098

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-38098", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.985Z", "datePublished": "2025-07-03T08:13:58.603Z", "dateUpdated": "2026-08-05T11:59:30.949Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:59:30.949Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink\n\nDon't try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector->base will \"work\" it's wrong and\nmight lead to unknown bad things. Just... don't."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached only through DRM_IOCTL_MODE_ATOMIC on the local /dev/dri/cardN node of an AMD GPU. There is no network or adjacent-network path to amdgpu_dm_atomic_check().\nAC:L - A single deterministic atomic ioctl (even DRM_MODE_ATOMIC_TEST_ONLY) that attaches the writeback connector to a CRTC triggers the confused dereference on the first iteration; there is no race and no memory-layout dependency, and DWB/writeback connectors are present by default on all DCN3.0+ (RDNA2 and newer) hardware.\nPR:L - The attacker needs only to open the card node and hold DRM master, which the logged-in unprivileged seat owner obtains via logind device ACLs or `video` group membership (and any process opening the node on a free VT becomes master automatically). No root, and no capability in the init namespace, is required.\nUI:N - The attacker performs the atomic commit entirely from its own process; no victim action, display hotplug, or administrator step is needed.\nS:U - The confused pointer is dereferenced in kernel context on behalf of the calling process, and the damage is confined to the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - On 6.8\u20136.13 (including 6.12 LTS) the confused `dc_link` is a live kernel heap pointer (`drm_encoder.name`), and the driver reads ~1.2 KB past that small allocation into neighbouring slab objects \u2014 an unbounded out-of-bounds kernel read, whose result is observable through the resulting bpc_limit/mode-validation outcome returned by the atomic ioctl.\nI:H - This is a type confusion (CWE-843) in which the kernel operates on a `drm_writeback_connector` through an incompatible `amdgpu_dm_connector` view and dereferences a pointer synthesized from foreign struct fields; on 6.14+ that pointer lands in the user-address range, so on hardware without SMAP/PAN the attacker maps a fully attacker-controlled fake `struct dc_link` and steers kernel mode-validation state. Scored H per the conservative treatment of type confusion, though I found no direct write through the confused pointer.\nA:H - On 6.14/6.15 the wild pointer (~0x0000000N00000005) is dereferenced from kernel mode, producing an immediate SMAP/PAN page fault and kernel oops; on earlier branches the far out-of-bounds read is a KASAN-reportable slab overflow that can also fault. The crash is triggerable repeatedly by an unprivileged local user with a single ioctl."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"], "versions": [{"version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "lessThan": "b14e726d57f61085485f107a6203c50a09695abd", "status": "affected", "versionType": "git"}, {"version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "lessThan": "18ca68f7c657721583a75cab01f0d0d2ec63a6c9", "status": "affected", "versionType": "git"}, {"version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "lessThan": "cbf4890c6f28fb1ad733e14613fbd33c2004bced", "status": "affected", "versionType": "git"}, {"version": "0fe85301b95077ac4fa4a91909d38b7341e81187", "status": "affected", "versionType": "git"}, {"version": "6.7.2", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.31", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.9", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.31"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.14.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd"}, {"url": "https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9"}, {"url": "https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced"}], "title": "drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b14e726d57f61085485f107a6203c50a09695abd", "status": "affected", "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "versionType": "git"}, {"lessThan": "18ca68f7c657721583a75cab01f0d0d2ec63a6c9", "status": "affected", "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "versionType": "git"}, {"lessThan": "cbf4890c6f28fb1ad733e14613fbd33c2004bced", "status": "affected", "version": "dbf5d3d02987faa0eec3710dd687cd912362d7b5", "versionType": "git"}, {"status": "affected", "version": "0fe85301b95077ac4fa4a91909d38b7341e81187", "versionType": "git"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.2", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h", "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.31", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E57E8C0A-CFAB-49DC-85D6-418A3F199253", "versionEndExcluding": "6.12.31", "versionStartIncluding": "6.7.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9B72DD1-715C-4101-A720-1C8D70044C06", "versionEndExcluding": "6.14.9", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink\n\nDon't try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector->base will \"work\" it's wrong and\nmight lead to unknown bad things. Just... don't."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/amd/display: No trate el conector wb como f\u00edsico en create_validate_stream_for_sink. No intente operar en un drm_wb_connector como un amdgpu_dm_connector. Aunque desreferenciar aconnector->base funciona, es incorrecto y podr\u00eda provocar problemas desconocidos. Simplemente... no lo haga."}], "id": "CVE-2025-38098", "lastModified": "2026-07-30T06:22:50.703", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-07-03T09:15:23.173", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/18ca68f7c657721583a75cab01f0d0d2ec63a6c9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b14e726d57f61085485f107a6203c50a09695abd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cbf4890c6f28fb1ad733e14613fbd33c2004bced"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: drm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink", "id": "2376080", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376080"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrm/amd/display: Don't treat wb connector as physical in create_validate_stream_for_sink\nDon't try to operate on a drm_wb_connector as an amdgpu_dm_connector.\nWhile dereferencing aconnector->base will \"work\" it's wrong and\nmight lead to unknown bad things. Just... don't."], "name": "CVE-2025-38098", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-07-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-38098\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-38098\nhttps://lore.kernel.org/linux-cve-announce/2025070305-CVE-2025-38098-2802@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-06T22:16:23.232742+00:00", "updated": "2025-07-06T22:16:23.232820+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}