CVE-2025-71305
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a slight chance we may end up with the wrong payload mask due to overflow if the delayed_destroy_work ends up coming into play after a DP 2.1 monitor gets disconnected which causes vcpi to become 0 then we try to make the payload = ~BIT(vcpi - 1) which is a negative shift. VCPI id should never really be 0 hence skip changing the payload mask if VCPI is 0. Otherwise it leads to <7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc [drm_display_helper]] port ffff888126ce9000 (3) <4> [515.287267] -----------[ cut here ]----------- <3> [515.287268] UBSAN: shift-out-of-bounds in ../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 <3> [515.287271] shift exponent -1 is negative <4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) <4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER <4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1645 03/15/2024 <4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work [drm_display_helper] <4> [515.287303] Call Trace: <4> [515.287304] <TASK> <4> [515.287306] dump_stack_lvl+0xc1/0xf0 <4> [515.287313] dump_stack+0x10/0x20 <4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 <4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 <4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d [drm_display_helper] <4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] <4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 <4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 <4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] <4> [515.287740] ? find_held_lock+0x31/0x90 <4> [515.287747] ? lock_release+0xce/0x2a0 <4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 <4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 <4> [515.287765] drm_atomic_commit+0x6e/0xf0 <4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 <4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 <4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 <4> [515.287795] ? mutex_lock_nested+0x1b/0x30 <4> [515.287801] drm_client_modeset_commit+0x26/0x50 <4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 <4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 <4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 <4> [515.287819] drm_client_hotplug+0x6c/0xf0 <4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 <4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 <4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 [drm_display_helper] <4> [515.287861] process_one_work+0x22b/0x6f0 <4> [515.287874] worker_thread+0x1e8/0x3d0 <4> [515.287879] ? __pfx_worker_thread+0x10/0x10 <4> [515.287882] kthread+0x11c/0x250 <4> [515.287886] ? __pfx_kthread+0x10/0x10 <4> [515.287890] ret_from_fork+0x2d7/0x310 <4> [515.287894] ? __pfx_kthread+0x10/0x10 <4> [515.287897] ret_from_fork_asm+0x1a/0x30
View original CVE JSON
{
"id": "CVE-2025-71305",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-27T14:16:43.000",
"lastModified": "2026-11-05T22:17:41.303",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/display/dp_mst: Add protection against 0 vcpi\n\nWhen releasing a timeslot there is a slight chance we may end up\nwith the wrong payload mask due to overflow if the delayed_destroy_work\nends up coming into play after a DP 2.1 monitor gets disconnected\nwhich causes vcpi to become 0 then we try to make the payload =\n~BIT(vcpi - 1) which is a negative shift. VCPI id should never\nreally be 0 hence skip changing the payload mask if VCPI is 0.\n\nOtherwise it leads to\n<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc\n[drm_display_helper]] port ffff888126ce9000 (3)\n<4> [515.287267] -----------[ cut here ]-----------\n<3> [515.287268] UBSAN: shift-out-of-bounds in\n../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36\n<3> [515.287271] shift exponent -1 is negative\n<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G\nS U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)\n<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P\nWIFI, BIOS 1645 03/15/2024\n<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work\n[drm_display_helper]\n<4> [515.287303] Call Trace:\n<4> [515.287304] <TASK>\n<4> [515.287306] dump_stack_lvl+0xc1/0xf0\n<4> [515.287313] dump_stack+0x10/0x20\n<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0\n<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0\n<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d\n[drm_display_helper]\n<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]\n<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0\n<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60\n<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]\n<4> [515.287740] ? find_held_lock+0x31/0x90\n<4> [515.287747] ? lock_release+0xce/0x2a0\n<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40\n<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140\n<4> [515.287765] drm_atomic_commit+0x6e/0xf0\n<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10\n<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0\n<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0\n<4> [515.287795] ? mutex_lock_nested+0x1b/0x30\n<4> [515.287801] drm_client_modeset_commit+0x26/0x50\n<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110\n<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140\n<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0\n<4> [515.287819] drm_client_hotplug+0x6c/0xf0\n<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0\n<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30\n<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410\n[drm_display_helper]\n<4> [515.287861] process_one_work+0x22b/0x6f0\n<4> [515.287874] worker_thread+0x1e8/0x3d0\n<4> [515.287879] ? __pfx_worker_thread+0x10/0x10\n<4> [515.287882] kthread+0x11c/0x250\n<4> [515.287886] ? __pfx_kthread+0x10/0x10\n<4> [515.287890] ret_from_fork+0x2d7/0x310\n<4> [515.287894] ? __pfx_kthread+0x10/0x10\n<4> [515.287897] ret_from_fork_asm+0x1a/0x30"
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndrm/display/dp_mst: Añadir protección contra vcpi 0\n\nAl liberar un timeslot, existe una ligera posibilidad de que terminemos con la máscara de carga útil incorrecta debido a un desbordamiento si el delayed_destroy_work entra en juego después de que un monitor DP 2.1 se desconecte, lo que hace que vcpi se convierta en 0. Entonces intentamos hacer que la carga útil sea = ~BIT(vcpi - 1), lo cual es un desplazamiento negativo. El ID de VCPI nunca debería ser realmente 0, por lo tanto, se omite cambiar la máscara de carga útil si VCPI es 0.\n\nDe lo contrario, conduce a\n<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc\n[drm_display_helper]] port ffff888126ce9000 (3)\n<4> [515.287267] -----------[ cut here ]-----------\n<3> [515.287268] UBSAN: shift-out-of-bounds in\n../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36\n<3> [515.287271] shift exponent -1 is negative\n<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G\nS U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)\n<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P\nWIFI, BIOS 1645 03/15/2024\n<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work\n[drm_display_helper]\n<4> [515.287303] Call Trace:\n<4> [515.287304] <TASK>\n<4> [515.287306] dump_stack_lvl+0xc1/0xf0\n<4> [515.287313] dump_stack+0x10/0x20\n<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0\n<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0\n<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d\n[drm_display_helper]\n<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]\n<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0\n<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60\n<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]\n<4> [515.287740] ? find_held_lock+0x31/0x90\n<4> [515.287747] ? lock_release+0xce/0x2a0\n<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40\n<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140\n<4> [515.287765] drm_atomic_commit+0x6e/0xf0\n<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10\n<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0\n<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0\n<4> [515.287795] ? mutex_lock_nested+0x1b/0x30\n<4> [515.287801] drm_client_modeset_commit+0x26/0x50\n<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110\n<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140\n<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0\n<4> [515.287819] drm_client_hotplug+0x6c/0xf0\n<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0\n<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30\n<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410\n[drm_display_helper]\n<4> [515.287861] process_one_work+0x22b/0x6f0\n<4> [515.287874] worker_thread+0x1e8/0x3d0\n<4> [515.287879] ? __pfx_worker_thread+0x10/0x10\n<4> [515.287882] kthread+0x11c/0x250\n<4> [515.287886] ? __pfx_kthread+0x10/0x10\n<4> [515.287890] ret_from_fork+0x2d7/0x310\n<4> [515.287894] ? __pfx_kthread+0x10/0x10\n<4> [515.287897] ret_from_fork_asm+0x1a/0x30"
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "95dbd525efce2a9e9e1c50ad15213de644c85ad0",
"versionType": "git",
"status": "affected"
},
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "ac9a7c329a5610051fc476644c9b9145a5965ecb",
"versionType": "git",
"status": "affected"
},
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "3f44cdb5371faf225af37d5caba8f21ec0572469",
"versionType": "git",
"status": "affected"
},
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "4d2ccdea18b564e3f73e3e543854acea64e6277d",
"versionType": "git",
"status": "affected"
},
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a",
"versionType": "git",
"status": "affected"
},
{
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"lessThan": "342ccffd9f77fc29fe1c05fd145e4d842bd2feaa",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.1",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.1",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.165",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.128",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.75",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.16",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.4",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-11-05T21:17:24.290311Z",
"id": "CVE-2025-71305",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1",
"versionEndExcluding": "6.1.165",
"matchCriteriaId": "96EF3286-5BCE-4D88-B8C9-4292E5BA7A18"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.128",
"matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.75",
"matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.16",
"matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.4",
"matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/342ccffd9f77fc29fe1c05fd145e4d842bd2feaa",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/3f44cdb5371faf225af37d5caba8f21ec0572469",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/4d2ccdea18b564e3f73e3e543854acea64e6277d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/95dbd525efce2a9e9e1c50ad15213de644c85ad0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/ac9a7c329a5610051fc476644c9b9145a5965ecb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}