Skip to main content

Linux Kernel CVE-2025-68184

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Mediatek
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local GPU/display access
  2. Delivery
    Launch GPU-accelerated app using Mesa v25
  3. Exploit
    Mesa negotiates default AFBC 32x8 modifier
  4. Execution
    MT8188 display controller fails scanout
  5. Persist
    vblank wait times out
  6. Impact
    Display pipeline hangs, stale framebuffer rendered

Vulnerability Assessment

Exploitation Conditions

Requires the MediaTek MT8188 SoC (validated on the Genio 700 EVK) running a Linux kernel that includes the AFBC-enabling commit c410fa9b07c3, combined with an AFBC-capable userspace GPU stack - specifically Mesa v25.0 or later, which selects the 32x8 split/sparse AFBC modifier by default. The attacker (or any local user) needs local access to submit GPU/display work through the DRM/KMS interface (PR:L, AV:L, no user interaction). Limiting factors: exploitation is confined to the specific MediaTek MT8188 hardware and does not apply to other SoCs or to configurations where AFBC is not negotiated (e.g. older Mesa or a linear-modifier fallback); it is not remotely reachable.
Impact

Signals are mixed and point to low real-world priority despite the 7.1 CVSS. The vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H indicates a local, low-privilege, no-interaction issue with high confidentiality and availability impact, but the description reads as a functional rendering breakage, not a memory-corruption or leak primitive - the C:H rating appears generous for what is garbled scanout of stale framebuffer data, and I assess confidentiality closer to Low. EPSS is 0.17% (7th percentile) and there is no KEV listing and no POC, so no exploitation activity is indicated. Crucially the flaw is hardware-gated to MT8188/Genio 700 with an AFBC-capable Mesa, which sharply narrows the exposed population. Net: a genuine local DoS/rendering fault on a specific SoC, not a broadly exploitable vulnerability; treat as a stability fix rather than an urgent security patch.
Exploit ScenarioDerived

A local user on an MT8188/Genio 700 device running an upstream kernel with AFBC enabled and Mesa v25.0+ simply launches a normal GPU-accelerated application; Mesa selects the AFBC modifier by default, the display controller cannot scan it out, and the compositor's atomic commit stalls with repeated vblank-wait timeouts, hanging or corrupting the display. No special exploit code is required - the condition arises during ordinary rendering - and no POC is published.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed. The fix disables AFBC support in the Mediatek DRM driver on the affected platform, delivered via the kernel.org stable commits listed in the references (e.g. git.kernel.org/stable/c/df1ad5de2197ea1b527d13ae7b699e9ee7d724d4 and the three sibling backports); apply your distribution's kernel update that incorporates these commits. As an interim workaround on MT8188/Genio 700 without the patch, prevent the AFBC path from being used - either pin Mesa below v25.0 or disable AFBC in the userspace GPU driver (e.g. force a linear/non-AFBC modifier), accepting reduced memory-bandwidth efficiency and slightly higher power/performance cost for the display pipeline. There is no security-sensitive data exposure that requires network controls; the compensating controls are purely about avoiding the broken compression path.

Affected ProductsAI

The Linux kernel Mediatek DRM driver (drivers/gpu/drm/mediatek) is affected specifically on MediaTek MT8188 SoCs (tested on the Genio 700 EVK platform) once AFBC support from commit c410fa9b07c3 is present. The condition is triggered in combination with upstream Mesa v25.0+ which enables AFBC by default. No CPE strings were provided in the intelligence set and no vendor advisory URL was supplied beyond the kernel.org stable commit references (git.kernel.org/stable/c/0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17, 72223700b620885d556a4c52a63f5294316176c6, 9882a40640036d5bbc590426a78981526d4f2345, df1ad5de2197ea1b527d13ae7b699e9ee7d724d4); exact affected kernel version ranges are not enumerated in the input.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected component is the Mediatek DRM (Direct Rendering Manager) KMS driver in the Linux kernel graphics stack. AFBC is a lossless bandwidth-saving framebuffer compression format negotiated between the GPU (via Mesa/panfrost) and the display controller through DRM format modifiers. Commit c410fa9b07c3 originally added AFBC support and advertised the 32x8 split/sparse modifier, but the MT8188 display controller does not correctly consume these AFBC surfaces, so scanout stalls and drm_atomic_helper_wait_for_vblanks times out (drivers/gpu/drm/drm_atomic_helper.c:1835). Because Mesa v25.0+ selects AFBC automatically, the broken path is exercised on default desktop/compositor workloads. The CWE is not assigned (N/A); functionally this is an incorrect hardware capability advertisement leading to a resource/timing fault, with the Information Disclosure tag reflecting the garbled (stale-memory) render output.

Know when Mediatek gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI 6.1 MEDIUM

Local GPU user triggers the default AFBC path (AV:L/AC:L/PR:L); display hangs give A:H, while garbled scanout leaks only limited stale memory (C:L) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Disable AFBC support on Mediatek DRM driver

Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM driver") added AFBC support to Mediatek DRM and enabled the 32x8/split/sparse modifier.

However, this is currently broken on Mediatek MT8188 (Genio 700 EVK platform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by default since Mesa v25.0.

Kernel trace reports vblank timeouts constantly, and the render is garbled:

[CRTC:62:crtc-0] vblank wait timed out
WARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
[...]
Hardware name: MediaTek Genio-700 EVK (DT)
Workqueue: events_unbound commit_work
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
lr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c
sp : ffff80008337bca0
x29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000
x26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000
x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80
x20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a
x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000
x14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b
x11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70
x8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70
x5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480
Call trace:
 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)
 drm_atomic_helper_commit_tail_rpm+0x64/0x80
 commit_tail+0xa4/0x1a4
 commit_work+0x14/0x20
 process_one_work+0x150/0x290
 worker_thread+0x2d0/0x3ec
 kthread+0x12c/0x210
 ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]---

Until this gets fixed upstream, disable AFBC support on this platform, as it's currently broken with upstream Mesa.

Executive ViewAI

Why It Matters

Mediatek MT8188 SoC display pipeline can be crashed by local users with graphics device access, causing permanent display lockup and potential stale framebuffer data exposure; this affects organizations deploying edge devices, IoT systems, or mobile platforms using Genio 700 chipsets. No vendor patch is currently available, requiring immediate access controls to mitigate the display denial-of-service risk.

Business Impact: Medium
Compensating Controls

Restrict local user access to /dev/dri and display subsystem devices. Disable AFBC modifier support in Mesa v25.0+ via MESA_EXTENSION_OVERRIDE or kernel boot parameters if performance trade-off is acceptable. No vendor-released patch identified at time of analysis; these mitigations are interim pending patch availability.

Threat Intelligence Overview

EPSS Score
0.2%
Top 93% exploitable
Prevalence
Low
MT8188-specific Mediatek DRM path; niche embedded/SoC footprint
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Mediatek

View all
CVE-2017-3216 CRITICAL POC
9.8 Jun 20

WiMAX routers based on the MediaTek SDK (libmtk) that use a custom httpd plugin are vulnerable to an authentication bypa
CVE-2024-20017 CRITICAL POC
9.8 Mar 04

In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
CVE-2019-15027 CRITICAL POC
9.8 Aug 14

The MediaTek Embedded Multimedia Card (eMMC) subsystem for Android on MT65xx, MT66xx, and MT8163 SoC devices allows atta
CVE-2016-6492 HIGH POC
7.8 Jan 12

The MT6573FDVT_SetRegHW function in camera_fdvt.c in the MediaTek driver for Linux allows local users to gain privileges
CVE-2023-32874 CRITICAL
9.8 Jan 02

In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check. Rated critical severity (CVSS
CVE-2025-20654 CRITICAL
9.8 Apr 07

In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
CVE-2025-20646 CRITICAL
9.8 Mar 03

In wlan AP FW, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS 9
CVE-2025-20672 CRITICAL
9.8 Jun 02

Heap OOB write in Android Bluetooth driver via incorrect bounds check.
CVE-2025-20674 CRITICAL
9.8 Jun 02

Remote privilege escalation in Android WLAN AP driver via packet injection.
CVE-2025-20684 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
CVE-2025-20683 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
CVE-2025-20682 CRITICAL
9.8 Jul 08

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/336723 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ REF https://git.kernel.org/stable/c/0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17 REF https://git.kernel.org/stable/c/72223700b620885d556a4c52a63f5294316176c6 REF https://git.kernel.org/stable/c/9882a40640036d5bbc590426a78981526d4f2345 REF https://git.kernel.org/stable/c/df1ad5de2197ea1b527d13ae7b699e9ee7d724d4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy