Skip to content
OpenAdvisories
Unscored CVE-2025-22093 EUVD-2025-11199GHSA-gjjg-hhwj-9mvj

drm/amd/display: avoid NPD when ASIC does not support DMUB

Published Apr 16, 2025 · Updated May 23, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.19 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.3 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Platform: Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: avoid NPD when ASIC does not support DMUB

ctx->dmub_srv will de NULL if the ASIC does not support DMUB, which is
tested in dm_dmub_sw_init.

However, it will be dereferenced in dmub_hw_lock_mgr_cmd if
should_use_dmub_lock returns true.

This has been the case since dmub support has been added for PSR1.

Fix this by checking for dmub_srv in should_use_dmub_lock.

[ 37.440832] BUG: kernel NULL pointer dereference, address: 0000000000000058
[ 37.447808] #PF: supervisor read access in kernel mode
[ 37.452959] #PF: error_code(0x0000) - not-present page
[ 37.458112] PGD 0 P4D 0
[ 37.460662] Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 37.465553] CPU: 2 UID: 1000 PID: 1745 Comm: DrmThread Not tainted 6.14.0-rc1-00003-gd62e938120f0 #23 99720e1cb1e0fc4773b8513150932a07de3c6e88
[ 37.478324] Hardware name: Google Morphius/Morphius, BIOS Google_Morphius.13434.858.0 10/26/2023
[ 37.487103] RIP: 0010:dmub_hw_lock_mgr_cmd+0x77/0xb0
[ 37.492074] Code: 44 24 0e 00 00 00 00 48 c7 04 24 45 00 00 0c 40 88 74 24 0d 0f b6 02 88 44 24 0c 8b 01 89 44 24 08 85 f6 75 05 c6 44 24 0e 01 <48> 8b 7f 58 48 89 e6 ba 01 00 00 00 e8 08 3c 2a 00 65 48 8b 04 5
[ 37.510822] RSP: 0018:ffff969442853300 EFLAGS: 00010202
[ 37.516052] RAX: 0000000000000000 RBX: ffff92db03000000 RCX: ffff969442853358
[ 37.523185] RDX: ffff969442853368 RSI: 0000000000000001 RDI: 0000000000000000
[ 37.530322] RBP: 0000000000000001 R08: 00000000000004a7 R09: 00000000000004a5
[ 37.537453] R10: 0000000000000476 R11: 0000000000000062 R12: ffff92db0ade8000
[ 37.544589] R13: ffff92da01180ae0 R14: ffff92da011802a8 R15: ffff92db03000000
[ 37.551725] FS: 0000784a9cdfc6c0(0000) GS:ffff92db2af00000(0000) knlGS:0000000000000000
[ 37.559814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 37.565562] CR2: 0000000000000058 CR3: 0000000112b1c000 CR4: 00000000003506f0
[ 37.572697] Call Trace:
[ 37.575152] <TASK>
[ 37.577258] ? __die_body+0x66/0xb0
[ 37.580756] ? page_fault_oops+0x3e7/0x4a0
[ 37.584861] ? exc_page_fault+0x3e/0xe0
[ 37.588706] ? exc_page_fault+0x5c/0xe0
[ 37.592550] ? asm_exc_page_fault+0x22/0x30
[ 37.596742] ? dmub_hw_lock_mgr_cmd+0x77/0xb0
[ 37.601107] dcn10_cursor_lock+0x1e1/0x240
[ 37.605211] program_cursor_attributes+0x81/0x190
[ 37.609923] commit_planes_for_stream+0x998/0x1ef0
[ 37.614722] update_planes_and_stream_v2+0x41e/0x5c0
[ 37.619703] dc_update_planes_and_stream+0x78/0x140
[ 37.624588] amdgpu_dm_atomic_commit_tail+0x4362/0x49f0
[ 37.629832] ? srso_return_thunk+0x5/0x5f
[ 37.633847] ? mark_held_locks+0x6d/0xd0
[ 37.637774] ? _raw_spin_unlock_irq+0x24/0x50
[ 37.642135] ? srso_return_thunk+0x5/0x5f
[ 37.646148] ? lockdep_hardirqs_on+0x95/0x150
[ 37.650510] ? srso_return_thunk+0x5/0x5f
[ 37.654522] ? _raw_spin_unlock_irq+0x2f/0x50
[ 37.658883] ? srso_return_thunk+0x5/0x5f
[ 37.662897] ? wait_for_common+0x186/0x1c0
[ 37.666998] ? srso_return_thunk+0x5/0x5f
[ 37.671009] ? drm_crtc_next_vblank_start+0xc3/0x170
[ 37.675983] commit_tail+0xf5/0x1c0
[ 37.679478] drm_atomic_helper_commit+0x2a2/0x2b0
[ 37.684186] drm_atomic_commit+0xd6/0x100
[ 37.688199] ? __cfi___drm_printfn_info+0x10/0x10
[ 37.692911] drm_atomic_helper_update_plane+0xe5/0x130
[ 37.698054] drm_mode_cursor_common+0x501/0x670
[ 37.702600] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10
[ 37.707572] drm_mode_cursor_ioctl+0x48/0x70
[ 37.711851] drm_ioctl_kernel+0xf2/0x150
[ 37.715781] drm_ioctl+0x363/0x590
[ 37.719189] ? __cfi_drm_mode_cursor_ioctl+0x10/0x10
[ 37.724165] amdgpu_drm_ioctl+0x41/0x80
[ 37.728013] __se_sys_ioctl+0x7f/0xd0
[ 37.731685] do_syscall_64+0x87/0x100
[ 37.735355] ? vma_end_read+0x12/0xe0
[ 37.739024] ? srso_return_thunk+0x5/0x5f
[ 37.743041] ? find_held_lock+0x47/0xf0
[ 37.746884] ? vma_end_read+0x12/0xe0
[ 37.750552] ? srso_return_thunk+0x5/0
---truncated---

Affected products

VendorProductAffectedFixed
Linux Linux 6.1.128 – < 6.1.134, 6.6.75 – < 6.6.87, 6.12.12 – < 6.12.23, 6.13 6.1.134

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.12.25-1 —
Debian 13 linux 6.12.25-1 —
Debian 12 linux 6.1.135-1 DSA-5907-1
Debian 11 linux-6.1 6.1.137-1~deb11u1 DLA-4193-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 linux-azure-fde No fix yet —
Ubuntu 25.04 linux 6.14.0-22.22 USN-7594-1
Ubuntu 25.04 linux-aws +3 6.14.0-1007.7 USN-7594-3, USN-7594-2, USN-7594-1
Ubuntu 25.04 linux-gcp 6.14.0-1008.8 USN-7594-1
Ubuntu 25.04 linux-realtime 6.14.0-1004.4 USN-7594-1
Ubuntu 24.04 LTS linux-realtime +1 No fix yet —
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +6 6.4.0-150700.53.3.1 SUSE-SU-2025:01951-1
SLES 15 SP7 kernel-azure +2 6.4.0-150700.20.3.1 SUSE-SU-2025:01967-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.3.1.150700.17.2.1 SUSE-SU-2025:01951-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.50.1 SUSE-SU-2025:01614-1
SLES 15 SP6 kernel-azure +2 6.4.0-150600.8.37.1 SUSE-SU-2025:01707-1
SLES 15 SP6 kernel-coco +3 6.4.0-15061.21.coco15sp6.1 SUSE-SU-2025:01919-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.50.1.150600.12.22.1 SUSE-SU-2025:01614-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 kernel-default-base 6.4.0-29.1.21.7 SUSE-SU-2025:20354-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_7 +1 1-1.2 SUSE-SU-2025:20355-1, SUSE-SU-2025:20354-1
SLE Micro 6.1 kernel-rt +1 6.4.0-31.1 SUSE-SU-2025:20355-1
SLE Micro 6.1 kernel-source +2 6.4.0-29.1 SUSE-SU-2025:20354-1
SLE Micro 6.0 kernel-default-base 6.4.0-29.1.21.7 SUSE-SU-2025:20343-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_7 +1 1-1.2 SUSE-SU-2025:20344-1, SUSE-SU-2025:20343-1
SLE Micro 6.0 kernel-rt +1 6.4.0-31.1 SUSE-SU-2025:20344-1
SLE Micro 6.0 kernel-source +2 6.4.0-29.1 SUSE-SU-2025:20343-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.3.1 SUSE-SU-2025:01951-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_1 1-150700.1.3.1 SUSE-SU-2025:01972-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_1 1-150700.15.3.1 SUSE-SU-2025:01951-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.50.1 SUSE-SU-2025:01614-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_11 1-150600.1.3.2 SUSE-SU-2025:01964-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_11 1-150600.13.3.1 SUSE-SU-2025:01614-1
SUSE Real Time Module 15 SP7 kernel-rt +3 6.4.0-150700.7.3.1 SUSE-SU-2025:01972-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.39.1 SUSE-SU-2025:01964-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +10 6.4.0-150600.23.50.1 SUSE-SU-2025:01614-1
openSUSE Leap 15.6 kernel-azure +2 6.4.0-150600.8.37.1 SUSE-SU-2025:01707-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.50.1.150600.12.22.1 SUSE-SU-2025:01614-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.39.1 SUSE-SU-2025:01964-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-101.33.4.3.el10uek ELSA-2025-20530, ELSA-2025-20480

Advisories 19

References