Junglewise Threat Intelligence

CVE-2025-68286: Linux Kernel amdgpu NULL pointer dereference in dc_stream_get_scanoutpos

CVE-2025-68286 · Severity: high · CVSS 7.8 · Published 2025-12-16

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's AMD display driver could allow a local user to crash the system. The issue occurs when the system attempts to manage display cursors while multiple monitors are connected, leading to a kernel panic. This primarily impacts system availability and could be used to disrupt operations on machines using AMD graphics hardware.

Technical details

A NULL pointer dereference exists in the 'dc_stream_get_scanoutpos' function within the 'amdgpu' driver (drivers/gpu/drm/amd/display/dc/core/dc_stream.c). The vulnerability is triggered during atomic modeset operations involving cursors, specifically when 'stream->ctx' is accessed without a prior NULL check. This was identified using the IGT 'kms_cursor_legacy' test suite on systems with both eDP and DP monitors connected. A local attacker can trigger this condition to cause a kernel Oops, resulting in a denial of service. The fix introduces a mandatory NULL check for 'stream->ctx' before accessing the display context and resource context.

Affected products

  • Linux Linux Kernel 4.15 to 6.16.0-99-custom

Timeline

  • 2025-11-07: disclosed: Initial patch authored by AMD engineers.
  • 2025-12-07: patched: Patch committed to stable kernel trees.
  • 2025-12-16: advisory: CVE-2025-68286 published.

References

Related threats