Out-of-Bound Access Vulnerability in Linux Kernel - CVE-2025-21985
Summary
CVE-2025-21985: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, vulnerabilities can arise, such as CVE-2025-21985, which affects the display driver for AMD graphics, potentially compromising system integrity.
Vulnerability Detail
CVE-2025-21985 is a vulnerability in the Linux kernel's AMD display driver that allows for out-of-bound accesses. The issue originates from the hpo_stream_to_link_encoder_mapping, which has a defined size of MAX_HPO_DP2_ENCODERS (4), while the location can be up to 6. This discrepancy can lead to memory corruption or crashes. Additionally, disp_cfg_stream_location can be used as an array index, which should be limited to the range of 0 to 5, necessitating adjustments to the ASSERT conditions to prevent out-of-bounds errors.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-21985 is a critical vulnerability in the Linux kernel's AMD display driver that can lead to serious security issues. It is essential to update your system to the patched version to mitigate risks. Regular monitoring and prompt updates are key to maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21985 is a vulnerability in the Linux kernel's AMD display driver that allows for out-of-bound memory accesses.
The vulnerability can lead to memory corruption, system crashes, or potential exploitation by malicious actors.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the manifest file. Visit Vulert Scanner to check your application without any signup.
Yes, a patch is available for Debian 13 in version 6.12.20-1. It is recommended to update your Linux package to this version.
While there are no specific workarounds, it is crucial to monitor your system for any unusual activity and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
