linux-cve-announce - CVE-2025-40288: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025120719-CVE-2025-40288-7d9f@gregkh>
Date: Sun,  7 Dec 2025 06:52:35 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40288: drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix NULL pointer dereference in VRAM logic for APU devices

Previously, APU platforms (and other scenarios with uninitialized VRAM managers)
triggered a NULL pointer dereference in `ttm_resource_manager_usage()`. The root
cause is not that the `struct ttm_resource_manager *man` pointer itself is NULL,
but that `man->bdev` (the backing device pointer within the manager) remains
uninitialized (NULL) on APUs—since APUs lack dedicated VRAM and do not fully
set up VRAM manager structures. When `ttm_resource_manager_usage()` attempts to
acquire `man->bdev->lru_lock`, it dereferences the NULL `man->bdev`, leading to
a kernel OOPS.

1. **amdgpu_cs.c**: Extend the existing bandwidth control check in
   `amdgpu_cs_get_threshold_for_moves()` to include a check for
   `ttm_resource_manager_used()`. If the manager is not used (uninitialized
   `bdev`), return 0 for migration thresholds immediately—skipping VRAM-specific
   logic that would trigger the NULL dereference.

2. **amdgpu_kms.c**: Update the `AMDGPU_INFO_VRAM_USAGE` ioctl and memory info
   reporting to use a conditional: if the manager is used, return the real VRAM
   usage; otherwise, return 0. This avoids accessing `man->bdev` when it is
   NULL.

3. **amdgpu_virt.c**: Modify the vf2pf (virtual function to physical function)
   data write path. Use `ttm_resource_manager_used()` to check validity: if the
   manager is usable, calculate `fb_usage` from VRAM usage; otherwise, set
   `fb_usage` to 0 (APUs have no discrete framebuffer to report).

This approach is more robust than APU-specific checks because it:
- Works for all scenarios where the VRAM manager is uninitialized (not just APUs),
- Aligns with TTM's design by using its native helper function,
- Preserves correct behavior for discrete GPUs (which have fully initialized
  `man->bdev` and pass the `ttm_resource_manager_used()` check).

v4: use ttm_resource_manager_used(&adev->mman.vram_mgr.manager) instead of checking the adev->gmc.is_app_apu flag (Christian)

The Linux kernel CVE team has assigned CVE-2025-40288 to this issue.

Affected and fixed versions
===========================

	Fixed in 6.1.159 with commit e70113b741ba253886cd71dbadfe3ea444bb2f5c
	Fixed in 6.6.117 with commit 1243e396148a65bb6c42a2b70fe43e50c16c494f
	Fixed in 6.12.59 with commit 43aa61c18a3a45042b098b7a1186ffb29364002c
	Fixed in 6.17.9 with commit 070bdce18fb12a49eb9c421e57df17d2ad29bf5f
	Fixed in 6.18 with commit 883f309add55060233bf11c1ea6947140372920f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40288
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
	drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
	drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e70113b741ba253886cd71dbadfe3ea444bb2f5c
	https://git.kernel.org/stable/c/1243e396148a65bb6c42a2b70fe43e50c16c494f
	https://git.kernel.org/stable/c/43aa61c18a3a45042b098b7a1186ffb29364002c
	https://git.kernel.org/stable/c/070bdce18fb12a49eb9c421e57df17d2ad29bf5f
	https://git.kernel.org/stable/c/883f309add55060233bf11c1ea6947140372920f