In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix slab-use-after-free in hdcp
The HDCP code in amdgpudmhdcp.c copies pointers to amdgpudmconnector objects without incrementing the kref reference counts. When using a USB-C dock, and the dock is unplugged, the corresponding amdgpudmconnector objects are freed, creating dangling pointers in the HDCP code. When the dock is plugged back, the dangling pointers are dereferenced, resulting in a slab-use-after-free:
[ 66.775837] BUG: KASAN: slab-use-after-free in eventpropertyvalidate+0x42f/0x6c0 [amdgpu] [ 66.776171] Read of size 4 at addr ffff888127804120 by task kworker/0:1/10
[ 66.776179] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.14.0-rc7-00180-g54505f727a38-dirty #233 [ 66.776183] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.17 12/18/2024 [ 66.776186] Workqueue: events eventpropertyvalidate [amdgpu] [ 66.776494] Call Trace: [ 66.776496] <TASK> [ 66.776497] dumpstacklvl+0x70/0xa0 [ 66.776504] printreport+0x175/0x555 [ 66.776507] ? _virtaddrvalid+0x243/0x450 [ 66.776510] ? kasancompletemodereportinfo+0x66/0x1c0 [ 66.776515] kasanreport+0xeb/0x1c0 [ 66.776518] ? eventpropertyvalidate+0x42f/0x6c0 [amdgpu] [ 66.776819] ? eventpropertyvalidate+0x42f/0x6c0 [amdgpu] [ 66.777121] _asanreportload4noabort+0x14/0x20 [ 66.777124] eventpropertyvalidate+0x42f/0x6c0 [amdgpu] [ 66.777342] ? _lockacquire+0x6b40/0x6b40 [ 66.777347] ? enableassr+0x250/0x250 [amdgpu] [ 66.777571] processonework+0x86b/0x1510 [ 66.777575] ? pwqdecnrinflight+0xcf0/0xcf0 [ 66.777578] ? assignwork+0x16b/0x280 [ 66.777580] ? lockisheldtype+0xa3/0x130 [ 66.777583] workerthread+0x5c0/0xfa0 [ 66.777587] ? processonework+0x1510/0x1510 [ 66.777588] kthread+0x3a2/0x840 [ 66.777591] ? kthreadispercpu+0xd0/0xd0 [ 66.777594] ? tracehardirqson+0x4f/0x60 [ 66.777597] ? rawspinunlockirq+0x27/0x60 [ 66.777599] ? calculatesigpending+0x77/0xa0 [ 66.777602] ? kthreadispercpu+0xd0/0xd0 [ 66.777605] retfromfork+0x40/0x90 [ 66.777607] ? kthreadispercpu+0xd0/0xd0 [ 66.777609] retfromforkasm+0x11/0x20 [ 66.777614] </TASK>
[ 66.777643] Allocated by task 10: [ 66.777646] kasansavestack+0x39/0x60 [ 66.777649] kasansavetrack+0x14/0x40 [ 66.777652] kasansaveallocinfo+0x37/0x50 [ 66.777655] _kasankmalloc+0xbb/0xc0 [ 66.777658] _kmalloccachenoprof+0x1c8/0x4b0 [ 66.777661] dmdpaddmstconnector+0xdd/0x5c0 [amdgpu] [ 66.777880] drmdpmstportaddconnector+0x47e/0x770 [drmdisplayhelper] [ 66.777892] drmdpsendlinkaddress+0x1554/0x2bf0 [drmdisplayhelper] [ 66.777901] drmdpcheckandsendlinkaddress+0x187/0x1f0 [drmdisplayhelper] [ 66.777909] drmdpmstlinkprobework+0x2b8/0x410 [drmdisplayhelper] [ 66.777917] processonework+0x86b/0x1510 [ 66.777919] workerthread+0x5c0/0xfa0 [ 66.777922] kthread+0x3a2/0x840 [ 66.777925] retfromfork+0x40/0x90 [ 66.777927] retfromforkasm+0x11/0x20
[ 66.777932] Freed by task 1713: [ 66.777935] kasansavestack+0x39/0x60 [ 66.777938] kasansavetrack+0x14/0x40 [ 66.777940] kasansavefreeinfo+0x3b/0x60 [ 66.777944] _kasanslabfree+0x52/0x70 [ 66.777946] kfree+0x13f/0x4b0 [ 66.777949] dmdpmstconnectordestroy+0xfa/0x150 [amdgpu] [ 66.778179] drmconnectorfree+0x7d/0xb0 [ 66.778184] drmmodeobjectput.part.0+0xee/0x160 [ 66.778188] drmmodeobjectput+0x37/0x50 [ 66.778191] drmatomicstatedefaultclear+0x220/0xd60 [ 66.778194] _drmatomicstatefree+0x16e/0x2a0 [ 66.778197] drmmodeatomicioctl+0x15ed/0x2ba0 [ 66.778200] drmioctlkernel+0x17a/0x310 [ 66.778203] drmioctl+0x584/0xd10 [ 66.778206] amdgpudrmioctl+0xd2/0x1c0 [amdgpu] [ 66.778375] _x64sysioctl+0x139/0x1a0 [ 66.778378] x64sys_call+0xee7/0xfb0 [ 66.778381] ---truncated---
[
{
"digest": {
"length": 406.0,
"function_hash": "193235538560358790344437017954298438219"
},
"target": {
"function": "hdcp_reset_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc66abcd297be67e3d835276e21e6fdc65205a6",
"id": "CVE-2025-37903-0593b12d",
"signature_type": "Function"
},
{
"digest": {
"length": 2005.0,
"function_hash": "12093893349918071758065992661506206305"
},
"target": {
"function": "update_config",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc66abcd297be67e3d835276e21e6fdc65205a6",
"id": "CVE-2025-37903-08f36a5d",
"signature_type": "Function"
},
{
"digest": {
"length": 1185.0,
"function_hash": "111398361966388283370952788022438278161"
},
"target": {
"function": "hdcp_update_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e25139c4aa5621f2db8e86688c33546cdd885e42",
"id": "CVE-2025-37903-193054f9",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"52494958718132352509683290723440804829",
"293087585939495577165918033349588262964",
"283011476037139502103418141301917007230",
"25939565805469665718899394123132978733",
"165866380722863815427418025483307689749",
"142619192105715859958014720130051625636",
"330949797471513838431475807193750572308",
"55741510968531823711589861549197652347",
"26104790323787294389679829760686323543",
"264486515269968403635427508549911976071",
"5782289320175478193225622183809463185",
"313627514617564245741624028195893423763",
"254505851805908265144979893668381016190",
"76926877910545610098799577736753851055",
"13895434839852623279324975198205877441",
"231058483751037856971894477245322619820",
"127788234960574827733275950031982678336",
"166822893876996725189665133804125191119",
"42259641807588449926048819063781475554",
"321090954589877458350292591746439270574",
"22410120355861282653977984884487996095",
"180348435580464341063597704628673839999"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd329f04dda35a66e0c9ed462ba91bd5f2c8be70",
"id": "CVE-2025-37903-27de6b0b",
"signature_type": "Line"
},
{
"digest": {
"length": 406.0,
"function_hash": "193235538560358790344437017954298438219"
},
"target": {
"function": "hdcp_reset_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a782a83d130ceac6c98a87639ddd89640bff486",
"id": "CVE-2025-37903-32d070c2",
"signature_type": "Function"
},
{
"digest": {
"length": 2005.0,
"function_hash": "12093893349918071758065992661506206305"
},
"target": {
"function": "update_config",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a782a83d130ceac6c98a87639ddd89640bff486",
"id": "CVE-2025-37903-35cff517",
"signature_type": "Function"
},
{
"digest": {
"length": 1185.0,
"function_hash": "111398361966388283370952788022438278161"
},
"target": {
"function": "hdcp_update_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc66abcd297be67e3d835276e21e6fdc65205a6",
"id": "CVE-2025-37903-39fb460d",
"signature_type": "Function"
},
{
"digest": {
"length": 652.0,
"function_hash": "227877839766675705668674800909517946241"
},
"target": {
"function": "hdcp_remove_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc66abcd297be67e3d835276e21e6fdc65205a6",
"id": "CVE-2025-37903-3a6e7abd",
"signature_type": "Function"
},
{
"digest": {
"length": 1185.0,
"function_hash": "111398361966388283370952788022438278161"
},
"target": {
"function": "hdcp_update_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be593d9d91c5a3a363d456b9aceb71029aeb3f1d",
"id": "CVE-2025-37903-55e99d63",
"signature_type": "Function"
},
{
"digest": {
"length": 2005.0,
"function_hash": "12093893349918071758065992661506206305"
},
"target": {
"function": "update_config",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd329f04dda35a66e0c9ed462ba91bd5f2c8be70",
"id": "CVE-2025-37903-60390382",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"52494958718132352509683290723440804829",
"293087585939495577165918033349588262964",
"283011476037139502103418141301917007230",
"25939565805469665718899394123132978733",
"165866380722863815427418025483307689749",
"142619192105715859958014720130051625636",
"330949797471513838431475807193750572308",
"55741510968531823711589861549197652347",
"26104790323787294389679829760686323543",
"264486515269968403635427508549911976071",
"5782289320175478193225622183809463185",
"313627514617564245741624028195893423763",
"254505851805908265144979893668381016190",
"76926877910545610098799577736753851055",
"13895434839852623279324975198205877441",
"231058483751037856971894477245322619820",
"127788234960574827733275950031982678336",
"166822893876996725189665133804125191119",
"42259641807588449926048819063781475554",
"321090954589877458350292591746439270574",
"22410120355861282653977984884487996095",
"180348435580464341063597704628673839999"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be593d9d91c5a3a363d456b9aceb71029aeb3f1d",
"id": "CVE-2025-37903-7007bca4",
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"52494958718132352509683290723440804829",
"293087585939495577165918033349588262964",
"283011476037139502103418141301917007230",
"25939565805469665718899394123132978733",
"165866380722863815427418025483307689749",
"142619192105715859958014720130051625636",
"330949797471513838431475807193750572308",
"55741510968531823711589861549197652347",
"26104790323787294389679829760686323543",
"264486515269968403635427508549911976071",
"5782289320175478193225622183809463185",
"313627514617564245741624028195893423763",
"254505851805908265144979893668381016190",
"76926877910545610098799577736753851055",
"13895434839852623279324975198205877441",
"231058483751037856971894477245322619820",
"127788234960574827733275950031982678336",
"166822893876996725189665133804125191119",
"42259641807588449926048819063781475554",
"321090954589877458350292591746439270574",
"22410120355861282653977984884487996095",
"180348435580464341063597704628673839999"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e25139c4aa5621f2db8e86688c33546cdd885e42",
"id": "CVE-2025-37903-7bc2898b",
"signature_type": "Line"
},
{
"digest": {
"length": 1185.0,
"function_hash": "111398361966388283370952788022438278161"
},
"target": {
"function": "hdcp_update_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a782a83d130ceac6c98a87639ddd89640bff486",
"id": "CVE-2025-37903-a102d8e5",
"signature_type": "Function"
},
{
"digest": {
"length": 406.0,
"function_hash": "193235538560358790344437017954298438219"
},
"target": {
"function": "hdcp_reset_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd329f04dda35a66e0c9ed462ba91bd5f2c8be70",
"id": "CVE-2025-37903-b1a30676",
"signature_type": "Function"
},
{
"digest": {
"length": 652.0,
"function_hash": "227877839766675705668674800909517946241"
},
"target": {
"function": "hdcp_remove_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be593d9d91c5a3a363d456b9aceb71029aeb3f1d",
"id": "CVE-2025-37903-b42b65c9",
"signature_type": "Function"
},
{
"digest": {
"length": 1956.0,
"function_hash": "235021686449093933270960870193060902978"
},
"target": {
"function": "update_config",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e25139c4aa5621f2db8e86688c33546cdd885e42",
"id": "CVE-2025-37903-bb1315eb",
"signature_type": "Function"
},
{
"digest": {
"length": 652.0,
"function_hash": "227877839766675705668674800909517946241"
},
"target": {
"function": "hdcp_remove_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd329f04dda35a66e0c9ed462ba91bd5f2c8be70",
"id": "CVE-2025-37903-bdc18ee4",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"52494958718132352509683290723440804829",
"293087585939495577165918033349588262964",
"283011476037139502103418141301917007230",
"25939565805469665718899394123132978733",
"165866380722863815427418025483307689749",
"142619192105715859958014720130051625636",
"330949797471513838431475807193750572308",
"55741510968531823711589861549197652347",
"26104790323787294389679829760686323543",
"264486515269968403635427508549911976071",
"5782289320175478193225622183809463185",
"313627514617564245741624028195893423763",
"254505851805908265144979893668381016190",
"76926877910545610098799577736753851055",
"13895434839852623279324975198205877441",
"231058483751037856971894477245322619820",
"127788234960574827733275950031982678336",
"166822893876996725189665133804125191119",
"42259641807588449926048819063781475554",
"321090954589877458350292591746439270574",
"22410120355861282653977984884487996095",
"180348435580464341063597704628673839999"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbc66abcd297be67e3d835276e21e6fdc65205a6",
"id": "CVE-2025-37903-c42325b6",
"signature_type": "Line"
},
{
"digest": {
"length": 406.0,
"function_hash": "193235538560358790344437017954298438219"
},
"target": {
"function": "hdcp_reset_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e25139c4aa5621f2db8e86688c33546cdd885e42",
"id": "CVE-2025-37903-c6ad0786",
"signature_type": "Function"
},
{
"digest": {
"length": 652.0,
"function_hash": "227877839766675705668674800909517946241"
},
"target": {
"function": "hdcp_remove_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a782a83d130ceac6c98a87639ddd89640bff486",
"id": "CVE-2025-37903-d5658896",
"signature_type": "Function"
},
{
"digest": {
"length": 2005.0,
"function_hash": "12093893349918071758065992661506206305"
},
"target": {
"function": "update_config",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be593d9d91c5a3a363d456b9aceb71029aeb3f1d",
"id": "CVE-2025-37903-d6e32835",
"signature_type": "Function"
},
{
"digest": {
"length": 1185.0,
"function_hash": "111398361966388283370952788022438278161"
},
"target": {
"function": "hdcp_update_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd329f04dda35a66e0c9ed462ba91bd5f2c8be70",
"id": "CVE-2025-37903-dd447937",
"signature_type": "Function"
},
{
"digest": {
"length": 406.0,
"function_hash": "193235538560358790344437017954298438219"
},
"target": {
"function": "hdcp_reset_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be593d9d91c5a3a363d456b9aceb71029aeb3f1d",
"id": "CVE-2025-37903-e45a89de",
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"52494958718132352509683290723440804829",
"293087585939495577165918033349588262964",
"283011476037139502103418141301917007230",
"25939565805469665718899394123132978733",
"165866380722863815427418025483307689749",
"142619192105715859958014720130051625636",
"330949797471513838431475807193750572308",
"55741510968531823711589861549197652347",
"26104790323787294389679829760686323543",
"264486515269968403635427508549911976071",
"5782289320175478193225622183809463185",
"313627514617564245741624028195893423763",
"254505851805908265144979893668381016190",
"76926877910545610098799577736753851055",
"13895434839852623279324975198205877441",
"231058483751037856971894477245322619820",
"127788234960574827733275950031982678336",
"166822893876996725189665133804125191119",
"42259641807588449926048819063781475554",
"321090954589877458350292591746439270574",
"22410120355861282653977984884487996095",
"180348435580464341063597704628673839999"
],
"threshold": 0.9
},
"target": {
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a782a83d130ceac6c98a87639ddd89640bff486",
"id": "CVE-2025-37903-ef5e5c97",
"signature_type": "Line"
},
{
"digest": {
"length": 652.0,
"function_hash": "227877839766675705668674800909517946241"
},
"target": {
"function": "hdcp_remove_display",
"file": "drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e25139c4aa5621f2db8e86688c33546cdd885e42",
"id": "CVE-2025-37903-f766454a",
"signature_type": "Function"
}
]