Buffer Overflow Vulnerability in Linux Kernel's AMD Display Driver
Summary
CVE-2025-38080: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Increase block_sequence array size [Why] It's possible to generate more than 50 steps in hwss_build_fast_sequence, for example with a 6... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing hardware resources and providing essential services for software applications. It supports a wide range of hardware architectures and is known for its stability and performance. The AMD display driver within the kernel is responsible for managing graphics output on systems using AMD graphics hardware. This driver is crucial for rendering graphics efficiently and ensuring compatibility with various display technologies.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the AMD display driver related to the block_sequence array size. The issue arises in the hwss_build_fast_sequence function, where it is possible to generate more than 50 steps, particularly in scenarios involving a 6-pipe ASIC with all pipes in a single MPC chain. This can lead to a buffer overflow in the block_sequence array, corrupting block_sequence_steps and potentially causing system crashes. The vulnerability is significant as it can lead to instability and unexpected behavior in systems utilizing the affected driver.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. Users are advised to apply the patch as soon as it becomes available.
Conclusion
The CVE-2025-38080 vulnerability in the Linux kernel's AMD display driver poses a significant risk of system instability due to a buffer overflow. Users are encouraged to update their systems to the patched version as soon as it becomes available to mitigate this risk.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38080 is a vulnerability in the Linux kernel's AMD display driver that can lead to a buffer overflow and system crashes.
This vulnerability can cause instability and crashes in systems using the AMD display driver, particularly under certain hardware configurations.
Yes, a patch is available for Debian 13 in version 6.12.32-1. Users of Debian 11 and 12 should check for updates.
While no specific workarounds are available, it is recommended to monitor for updates and apply them as soon as possible.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
