From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A501318CBE1 for ; Mon, 8 Dec 2025 00:48:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765154899; cv=none; b=Xm6rY0kCji7cOBgTjUOm1HQSmjSXdpBPB/otL9zp/eUGk0ZOnAhPOyw1gikNBbbIEp5dmyGgAXRTswRN/HJ+a0z1qds5VVvRNn5d/+odYapefP3Ho2fv8IjApqlLo+cQnDWE5yYekLxPDOegtjN3b4pCPCghSAdPwLKXnjqApIo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765154899; c=relaxed/simple; bh=lCLDMK6YcODiUf+ik3tYWXUkWHGSXmlXo6npelsZV74=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=d2ua785wIUYJjqDDkuG3W1oaJgYBY+w5+lv9SefP/lEUDQN91ouiIOuJ+89AT2/A1/FJzTadxYoSAl26wZgYP19Cwxrp+AGN3KOsEydoe7FbHWfOhcqRigeiFIVmNcmp4eQTCa1xSsvoPNkezjBv/sFCqycD2SjRNju0iUoCLe8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cTjzGrE3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cTjzGrE3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 275B1C4CEFB; Mon, 8 Dec 2025 00:48:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1765154899; bh=lCLDMK6YcODiUf+ik3tYWXUkWHGSXmlXo6npelsZV74=; h=From:To:Cc:Subject:Date:Reply-To:From; b=cTjzGrE3xZjKSDBxv8fxujvftPHXyiLYYzArGWdBxMZ6WTk7XclucdTDywdyVFfrb 7WUQxqw3C62cV43ZYTmCMgKWPbtvgAeqb3jdRdsRtHvKgXazAEP9aJRjcY+7kC+u4o ehnxKomVy9OLpROXu4Swqoyl7C99unw994Nar5Ns= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2025-40316: drm/mediatek: Fix device use-after-free on unbind Date: Mon, 8 Dec 2025 09:47:40 +0900 Message-ID: <2025120822-CVE-2025-40316-eeed@gregkh> X-Mailer: git-send-email 2.52.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2960; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=pKdrCsOXSHKp0vBSN7ftowW9+//cb5p+/2lU9sQpwHo=; b=owGbwMvMwCRo6H6F97bub03G02pJDJlmClLLeratLOF/d6rv13FTfdFjSz9vj9nwk+dAcMT/1 ZG5BVJCHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCR66UMC/psAl9ccJywIvqh ukBra4Hb2sPZHgzzjNkm27iwuITe7K4Tbcm7+9Lwht91AA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix device use-after-free on unbind A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers"). This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free. Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. The Linux kernel CVE team has assigned CVE-2025-40316 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.105 with commit 7d98166183d627c0b9daca7672b2191fae0f8a03 and fixed in 6.6.117 with commit a5a896f8315de358a2932e2c23c42d550256046a Issue introduced in 6.12.45 with commit 31ce7c089b50c3d3056c37e0e25e7535e4428ae1 and fixed in 6.12.58 with commit 0142fe895986addf35885b43440718e567121155 Issue introduced in 6.17 with commit 1f403699c40f0806a707a9a6eed3b8904224021a and fixed in 6.17.8 with commit 8ba827e09eb586e952d10e39406fa02d10bb591e Issue introduced in 6.17 with commit 1f403699c40f0806a707a9a6eed3b8904224021a and fixed in 6.18 with commit 926d002e6d7e2f1fd5c1b53cf6208153ee7d380d Issue introduced in 6.16.5 with commit fae58d0155a979a8c414bbc12db09dd4b2f910d0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-40316 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpu/drm/mediatek/mtk_drm_drv.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a5a896f8315de358a2932e2c23c42d550256046a https://git.kernel.org/stable/c/0142fe895986addf35885b43440718e567121155 https://git.kernel.org/stable/c/8ba827e09eb586e952d10e39406fa02d10bb591e https://git.kernel.org/stable/c/926d002e6d7e2f1fd5c1b53cf6208153ee7d380d