Skip to main content

Linux Kernel CVE-2025-40354

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux Amd
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local low-priv access on AMD host
  2. Delivery
    Attach/exercise USB4 DisplayPort (DPIA) device
  3. Exploit
    Driver requests 14 links into size-12 array
  4. Execution
    Out-of-bounds access and NULL link->enc in hw_init()
  5. Persist
    Kernel memory corruption or crash
  6. Impact
    Denial of service (system panic)

Vulnerability Assessment

Exploitation Conditions

Requires local access (AV:L) with low privileges (PR:L) on a system running the affected AMD amdgpu Display Core driver, plus AMD graphics hardware and a DPIA code path - i.e., DisplayPort tunneling over USB4/Thunderbolt endpoints that are non-standard display endpoints, which is what produces the >12 link count and the NULL link->enc during hw_init(). Limiting factors: the bug is confined to AMD GPUs with DPIA/USB4 DisplayPort configurations, is reached at driver/hardware-init time rather than through arbitrary remote input, needs local privileges, and no user interaction is required (UI:N); systems without AMD graphics or without USB4/Thunderbolt DP tunneling are not exposed.
Impact

Signals are mixed and lean toward moderate, localized risk rather than an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H = 7.8) implies high confidentiality/integrity/availability impact from a low-privileged local user, but the tag set explicitly labels this 'Denial Of Service' and the code description (array over-read/over-access plus NULL deref) points to a kernel crash rather than reliable code execution - so the C:H/I:H portion of the official vector is likely overstated relative to the real-world DoS impact. EPSS is low (0.17%, 7th percentile), there is no KEV listing, and no POC is referenced, all consistent with a low likelihood of opportunistic mass exploitation. Exploitation also realistically requires AMD graphics hardware and a DPIA/USB4 DisplayPort tunneling configuration to reach the vulnerable path, which further narrows the exposed population. Net: patch it in the normal kernel-update cycle; it is not a drop-everything emergency.
Exploit ScenarioDerived

A local low-privileged user on a machine with an AMD GPU attaches or exercises a USB4/Thunderbolt DisplayPort (DPIA) device so the driver requests more links than the undersized array holds and hits the NULL link->enc during hw_init(), corrupting kernel memory or dereferencing NULL and crashing the system (denial of service). No public exploit is identified at time of analysis, and reliable privilege escalation beyond a crash is not demonstrated in the available data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Kernel memory corruption in the Linux kernel's AMD Display (amdgpu/DC) driver stems from an undersized dc->links[MAX_LINKS] array and an unchecked link->enc pointer, letting a local attacker on AMD-GPU systems trigger an out-of-bounds access and NULL-pointer dereference during hw_init() for DisplayPort-over-USB4 (DPIA) endpoints. Rated CVSS 7.8 (AV:L/PR:L) and tagged as denial-of-service, it most realistically causes a kernel crash. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.17% (7th percentile).

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data - apply the kernel update from your distribution that incorporates stable commits a3fc0d36cfb927f8986b83bf5fba47dbedad3c63, bec947cbe9a65783adb475a5fb47980d7b4f4796, and f28092be4e12b7df9e4f415d25bf0d767bc2d9ed (mainline d7f5a61e1b04ed87b008c8d327649d184dc5bb45), which raises MAX_LINKS from 12 to 14 and guards the link->enc NULL access. Track your distribution's security advisory for the exact rebuilt kernel package version and reboot into the patched kernel. If immediate patching is not possible, the practical compensating control is to avoid the trigger path: restrict use of USB4/Thunderbolt DisplayPort (DPIA) tunneling docks and displays on affected AMD systems, and limit untrusted local user access to affected machines - the trade-off is loss of USB4/Thunderbolt external-display functionality. Standard kernel hardening (restricting local shell access, minimizing local users) reduces the low-privilege local exposure but does not remove the defect.

Affected ProductsAI

The affected component is the Linux kernel's amdgpu DRM 'drm/amd/display' (Display Core) subsystem on systems using AMD graphics. Specific fixed/affected version ranges are not enumerated in the provided data (no CPE strings supplied), so exact vulnerable kernel versions should be confirmed against the stable-tree commits: the fix appears across git.kernel.org/stable commits a3fc0d36cfb927f8986b83bf5fba47dbedad3c63, bec947cbe9a65783adb475a5fb47980d7b4f4796, and f28092be4e12b7df9e4f415d25bf0d767bc2d9ed (cherry-picked from mainline commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45). Only kernels containing the AMD DC link-array code with MAX_LINKS=12 and DPIA support are in scope.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the AMD Display Core (DC) component of the amdgpu DRM driver. Two distinct defects were resolved: first, the fixed-size links array (dc->links[MAX_LINKS]) was declared with capacity 12 while the driver can legitimately request up to 14 links (max_connector + max_dpia + 4 virtual links), producing an out-of-bounds array access; second, hw_init() dereferences a link encoder (link->enc) that is NULL for DPIA (DisplayPort tunneling over USB4/Thunderbolt) links that are not standard display endpoints. The root cause classes are an out-of-bounds/incorrect array-size condition (CWE-787/CWE-129 family) combined with a NULL-pointer dereference (CWE-476); the upstream CWE field is unpopulated (N/A) in the source data. DPIA links are the trigger surface, meaning USB4/Thunderbolt DisplayPort tunneling paths are the relevant technology.

Know when Amd gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.7 MEDIUM

Local low-priv trigger but requires AMD GPU plus DPIA/USB4 DisplayPort config (AC:H); realistic impact is a kernel crash, so A:H with C:N/I:N.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: increase max link count and fix link->enc NULL pointer access

[why] 1.) dc->links[MAX_LINKS] array size smaller than actual requested. max_connector + max_dpia + 4 virtual = 14. increase from 12 to 14.

2.) hw_init() access null LINK_ENC for dpia non display_endpoint.

(cherry picked from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45)

Executive ViewAI

Why It Matters

A denial-of-service vulnerability in the Linux kernel's AMD Display driver (CVE-2025-40354, CVSS 7.8) allows authenticated local users with AMD GPU hardware to trigger kernel crashes and render systems unavailable. Organizations running Linux with AMD GPU infrastructure should assess exposure and implement access controls immediately, as no patch is currently available from the vendor.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: restricting device access via file permissions (chmod 640 on /dev/dri/renderD* nodes), enforcing strict local user access policies to minimize attack surface, disabling GPU driver support for non-critical systems, deploying SELinux or AppArmor to confine amdgpu driver capabilities, and enabling kernel crash/panic detection with real-time alerting to detect potential exploitation.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
High
AMD GPU display driver in mainline Linux kernel, very widely deployed
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2026-46174 HIGH POC
8.8 May 28

Local privilege escalation and information disclosure in the Linux kernel on AMD Zen2 CPUs allows low-privileged users t
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8781-1 ADVISORY https://vuldb.com/vuln/336717 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ REF https://git.kernel.org/stable/c/a3fc0d36cfb927f8986b83bf5fba47dbedad3c63 REF https://git.kernel.org/stable/c/bec947cbe9a65783adb475a5fb47980d7b4f4796 REF https://git.kernel.org/stable/c/f28092be4e12b7df9e4f415d25bf0d767bc2d9ed

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy