What is the CVSS score of CVE-2025-68184?

CVE-2025-68184 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2025-68184?

Mediatek MT8188 SoC display pipeline can be crashed by local users with graphics device access, causing permanent display lockup and potential stale framebuffer data exposure; this affects…. A patch is available.

How to fix or mitigate CVE-2025-68184?

Within 24 hours, inventory all systems running Linux on Mediatek MT8188/Genio 700 SoCs and classify those permitting user-level GPU/display access. Within 7 days, restrict GPU device access to trusted system accounts only, and evaluate disabling AFBC frame buffer compression in Mesa configuration or kernel parameters if workload performance allows. Within 30 days, establish a quarterly review process to monitor Mediatek and kernel.org security advisories for patch availability; no vendor-released patch identified at time of analysis, so document remediation procedures for automated deployment once patches are released.

Linux Kernel CVE-2025-68184

HIGH

2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Mediatek Linux Information Disclosure Red Hat Suse

7.1

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

6.1 MEDIUM

Local GPU user triggers the default AFBC path (AV:L/AC:L/PR:L); display hangs give A:H, while garbled scanout leaks only limited stale memory (C:L) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 07:25 vuln.today

CVE Published

Dec 16, 2025 - 14:15 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Disable AFBC support on Mediatek DRM driver

Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") added AFBC support to Mediatek DRM and enabled the 32x8/split/sparse modifier.

However, this is currently broken on Mediatek MT8188 (Genio 700 EVK platform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by default since Mesa v25.0.

Kernel trace reports vblank timeouts constantly, and the render is garbled:

[CRTC:62:crtc-0] vblank wait timed out
WARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
[...]
Hardware name: MediaTek Genio-700 EVK (DT)
Workqueue: events_unbound commit_work
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
lr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
sp : ffff80008337bca0
x29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000
x26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000
x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80
x20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a
x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000
x14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b
x11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70
x8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70
x5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480
Call trace:
 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)
 drm_atomic_helper_commit_tail_rpm+0x64/0x80
 commit_tail+0xa4/0x1a4
 commit_work+0x14/0x20
 process_one_work+0x150/0x290
 worker_thread+0x2d0/0x3ec
 kthread+0x12c/0x210
 ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]---

Until this gets fixed upstream, disable AFBC support on this platform, as it's currently broken with upstream Mesa.

AnalysisAI

Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.

Technical ContextAI

The affected component is the Mediatek DRM (Direct Rendering Manager) KMS driver in the Linux kernel graphics stack. AFBC is a lossless bandwidth-saving framebuffer compression format negotiated between the GPU (via Mesa/panfrost) and the display controller through DRM format modifiers. Commit c410fa9b07c3 originally added AFBC support and advertised the 32x8 split/sparse modifier, but the MT8188 display controller does not correctly consume these AFBC surfaces, so scanout stalls and drm_atomic_helper_wait_for_vblanks times out (drivers/gpu/drm/drm_atomic_helper.c:1835). Because Mesa v25.0+ selects AFBC automatically, the broken path is exercised on default desktop/compositor workloads. The CWE is not assigned (N/A); functionally this is an incorrect hardware capability advertisement leading to a resource/timing fault, with the Information Disclosure tag reflecting the garbled (stale-memory) render output.

Affected ProductsAI

The Linux kernel Mediatek DRM driver (drivers/gpu/drm/mediatek) is affected specifically on MediaTek MT8188 SoCs (tested on the Genio 700 EVK platform) once AFBC support from commit c410fa9b07c3 is present. The condition is triggered in combination with upstream Mesa v25.0+ which enables AFBC by default. No CPE strings were provided in the intelligence set and no vendor advisory URL was supplied beyond the kernel.org stable commit references (git.kernel.org/stable/c/0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17, 72223700b620885d556a4c52a63f5294316176c6, 9882a40640036d5bbc590426a78981526d4f2345, df1ad5de2197ea1b527d13ae7b699e9ee7d724d4); exact affected kernel version ranges are not enumerated in the input.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. The fix disables AFBC support in the Mediatek DRM driver on the affected platform, delivered via the kernel.org stable commits listed in the references (e.g. git.kernel.org/stable/c/df1ad5de2197ea1b527d13ae7b699e9ee7d724d4 and the three sibling backports); apply your distribution's kernel update that incorporates these commits. As an interim workaround on MT8188/Genio 700 without the patch, prevent the AFBC path from being used - either pin Mesa below v25.0 or disable AFBC in the userspace GPU driver (e.g. force a linear/non-AFBC modifier), accepting reduced memory-bandwidth efficiency and slightly higher power/performance cost for the display pipeline. There is no security-sensitive data exposure that requires network controls; the compensating controls are purely about avoiding the broken compression path.

More in Mediatek

View all

CVE-2017-3216 CRITICAL Act Now POC

9.8 Jun 20

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa

CVE-2019-15027 CRITICAL Act Now POC

9.8 Aug 14

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows atta

CVE-2016-6492 HIGH This Week POC

7.8 Jan 12

The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges

CVE-2021-37584 HIGH This Week

8.8 Dec 26

MediaTek microchips, as used in NETGEAR devices through 2021-11-11 and other devices, mishandle the WPS (Wi-Fi Protected

CVE-2021-37583 HIGH This Week

8.8 Dec 26