Junglewise Threat Intelligence

CVE-2025-71305: Linux Kernel shift-out-of-bounds in drm_dp_mst_topology.c

CVE-2025-71305 · Severity: info · CVSS 4.6 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's display driver could cause a system crash when a high-end monitor (DisplayPort 2.1) is disconnected. This occurs due to a technical error in how the system manages video bandwidth slots during the disconnection process. While it does not expose data, it can lead to an immediate denial of service (system hang or crash) requiring a reboot.

Technical details

A shift-out-of-bounds vulnerability exists in `drivers/gpu/drm/display/drm_dp_mst_topology.c` within the `drm_dp_atomic_release_time_slots` function. When a DisplayPort 2.1 monitor is disconnected, a race condition involving `delayed_destroy_work` can cause the Virtual Circuit Payload ID (VCPI) to become 0. The code subsequently attempts to calculate a payload mask using `~BIT(vcpi - 1)`, resulting in a negative shift exponent (-1). This triggers a kernel panic or undefined behavior (UBSAN). The fix introduces a check to ensure `vcpi` is greater than 0 before performing the bitwise shift.

Affected products

  • Linux Linux Kernel DP 2.1 monitor support in drm/display/dp_mst component

Timeline

  • 2025-11-19: disclosed: Initial patch submitted by Intel
  • 2026-03-04: patched: Backported to stable branches by Sasha Levin
  • 2026-05-27: advisory: CVE-2025-71305 published

References