CVE-2025-40148
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions The function dc_stream_set_cursor_attributes() currently dereferences the `stream` pointer and nested members `stream->ctx->dc->current_state` without checking for NULL. All callers of these functions, such as in `dcn30_apply_idle_power_optimizations()` and `amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks before calling these functions. Fixes below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes() error: we previously assumed 'stream' could be null (see line 334) drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c 327 bool dc_stream_program_cursor_attributes( 328 struct dc_stream_state *stream, 329 const struct dc_cursor_attributes *attributes) 330 { 331 struct dc *dc; 332 bool reset_idle_optimizations = false; 333 334 dc = stream ? stream->ctx->dc : NULL; ^^^^^^ The old code assumed stream could be NULL. 335 --> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) { ^^^^^^ The refactor added an unchecked dereference. drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c 313 bool dc_stream_set_cursor_attributes( 314 struct dc_stream_state *stream, 315 const struct dc_cursor_attributes *attributes) 316 { 317 bool result = false; 318 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here. This function used to check for if stream as NULL and return false at the start. Probably we should add that back.
View original CVE JSON
{
"id": "CVE-2025-40148",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-11-12T11:15:44.700",
"lastModified": "2026-10-19T21:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add NULL pointer checks in dc_stream cursor attribute functions\n\nThe function dc_stream_set_cursor_attributes() currently dereferences\nthe `stream` pointer and nested members `stream->ctx->dc->current_state`\nwithout checking for NULL.\n\nAll callers of these functions, such as in\n`dcn30_apply_idle_power_optimizations()` and\n`amdgpu_dm_plane_handle_cursor_update()`, already perform NULL checks\nbefore calling these functions.\n\nFixes below:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()\nerror: we previously assumed 'stream' could be null (see line 334)\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 327 bool dc_stream_program_cursor_attributes(\n 328 struct dc_stream_state *stream,\n 329 const struct dc_cursor_attributes *attributes)\n 330 {\n 331 struct dc *dc;\n 332 bool reset_idle_optimizations = false;\n 333\n 334 dc = stream ? stream->ctx->dc : NULL;\n ^^^^^^\nThe old code assumed stream could be NULL.\n\n 335\n--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {\n ^^^^^^\nThe refactor added an unchecked dereference.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 313 bool dc_stream_set_cursor_attributes(\n 314 struct dc_stream_state *stream,\n 315 const struct dc_cursor_attributes *attributes)\n 316 {\n 317 bool result = false;\n 318\n 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Here.\nThis function used to check for if stream as NULL and return false at\nthe start. Probably we should add that back."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/amd/display: Añadir comprobaciones de puntero NULL en las funciones de atributo de cursor dc_stream\n\nLa función dc_stream_set_cursor_attributes() actualmente desreferencia el puntero 'stream' y los miembros anidados 'stream->ctx->dc->current_state' sin comprobar si es NULL.\n\nTodos los llamadores de estas funciones, como en 'dcn30_apply_idle_power_optimizations()' y 'amdgpu_dm_plane_handle_cursor_update()', ya realizan comprobaciones de NULL antes de llamar a estas funciones.\n\nCorrecciones a continuación:\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c:336 dc_stream_program_cursor_attributes()\nerror: anteriormente asumimos que 'stream' podría ser nulo (ver línea 334)\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 327 bool dc_stream_program_cursor_attributes(\n 328 struct dc_stream_state *stream,\n 329 const struct dc_cursor_attributes *attributes)\n 330 {\n 331 struct dc *dc;\n 332 bool reset_idle_optimizations = false;\n 333\n 334 dc = stream ? stream->ctx->dc : NULL;\n ^^^^^^\nEl código antiguo asumía que stream podría ser NULL.\n\n 335\n--> 336 if (dc_stream_set_cursor_attributes(stream, attributes)) {\n ^^^^^^\nLa refactorización añadió una desreferencia sin comprobar.\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_stream.c\n 313 bool dc_stream_set_cursor_attributes(\n 314 struct dc_stream_state *stream,\n 315 const struct dc_cursor_attributes *attributes)\n 316 {\n 317 bool result = false;\n 318\n 319 if (dc_stream_check_cursor_attributes(stream, stream->ctx->dc->current_state, attributes)) {\n ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Aquí.\nEsta función solía comprobar si stream era NULL y devolver false al principio. Probablemente deberíamos volver a añadir eso."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc_stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4465dd0e41e8223a46a41ce4fcdfc55fabd319d8",
"lessThan": "01e793e7d4d402c473f1a61ca5824f086693be65",
"versionType": "git",
"status": "affected"
},
{
"version": "4465dd0e41e8223a46a41ce4fcdfc55fabd319d8",
"lessThan": "bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc_stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.16",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.16",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.17.3",
"lessThanOrEqual": "6.17.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/01e793e7d4d402c473f1a61ca5824f086693be65",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf4e4b97d0fdc66f04fc19d807e24dd8421b8f11",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}