CVE-2025-21985
published 2025-04-01CVE-2025-21985: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping…
PriorityP427high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.18%
8.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bound accesses
[WHAT & HOW]
hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),
but location can have size up to 6. As a result, it is necessary to
check location against MAX_HPO_DP2_ENCODERS.
Similiarly, disp_cfg_stream_location can be used as an array index which
should be 0..5, so the ASSERT's conditions should be less without equal.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.20-1 (forky) | linux 6.12.20-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 36793d90d76f667d26c6dd025571481ee0c96abc | 36793d90d76f667d26c6dd025571481ee0c96abc |
| linux | linux | >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 9aedc776b11038f04f4641241bb7e877781e4aa4 | 9aedc776b11038f04f4641241bb7e877781e4aa4 |
| linux | linux | >= 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c < 8adbb2a98b00926315fd513b5fe2596b5716b82d | 8adbb2a98b00926315fd513b5fe2596b5716b82d |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.12.20-1 | 6.12.20-1 |
| linux | linux_kernel | >= 0 < 6.12.20-1 | 6.12.20-1 |
| linux | linux_kernel | >= 4.15 < 6.12.20 | 6.12.20 |
| linux | linux_kernel | >= 6.13 < 6.13.8 | 6.13.8 |
| msrc | azl3_kernel_6.6.104.2-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.112.1-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.117.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.119.3-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.119.3-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.121.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.130.1-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.96.2-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.96.2-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
drm/amd/display: Fix out-of-bound accesses
vendor_msrc·2025-04-08·CVSS 5.5
CVE-2025-21985 [HIGH] CWE-125 drm/amd/display: Fix out-of-bound accesses
drm/amd/display: Fix out-of-bound accesses
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Red Hat
kernel: drm/amd/display: Fix out-of-bound accesses
vendor_redhat·2025-04-01·CVSS 7.1
CVE-2025-21985 [HIGH] CWE-787 kernel: drm/amd/display: Fix out-of-bound accesses
kernel: drm/amd/display: Fix out-of-bound accesses
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bound accesses
[WHAT & HOW]
hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),
but location can have size up to 6. As a result, it is necessary to
check location against MAX_HPO_DP2_ENCODERS.
Similiarly, disp_cfg_stream_location can be used as an array index which
should be 0..5, so the ASSERT's conditions should be less without equal.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) -
Debian
CVE-2025-21985: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis...
vendor_debian·2025·CVSS 7.1
CVE-2025-21985 [HIGH] CVE-2025-21985: linux - In the Linux kernel, the following vulnerability has been resolved: drm/amd/dis...
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 6.12.20-1)
sid: resolved (fixed in 6.12.20-1)
trixie: resolved (fixed in 6.12.20-1)
VulDB
Linux Kernel up to 6.12.19/6.13.7 AMD Display array index (EUVD-2025-9335 / Nessus ID 237088)
vuldb·2026-07-31·CVSS 7.1
CVE-2025-21985 [HIGH] Linux Kernel up to 6.12.19/6.13.7 AMD Display array index (EUVD-2025-9335 / Nessus ID 237088)
A vulnerability, which was classified as problematic, was found in Linux Kernel up to 6.12.19/6.13.7. This affects an unknown part of the component AMD Display. Such manipulation leads to improper validation of array index.
This vulnerability is uniquely identified as CVE-2025-21985. The attack can only be initiated within the local network. No exploit exists.
You should upgrade the affected component.
OSV
CVE-2025-21985: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder
osv·2025-04-01·CVSS 7.1
CVE-2025-21985 [HIGH] CVE-2025-21985: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.
GHSA
GHSA-6hmr-pwgj-w283: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bound accesses
[WHAT & HOW]
hpo_stream_to_link_encod
ghsa_unreviewed·2025-04-01
CVE-2025-21985 [HIGH] CWE-125 GHSA-6hmr-pwgj-w283: In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bound accesses
[WHAT & HOW]
hpo_stream_to_link_encod
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bound accesses
[WHAT & HOW]
hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4),
but location can have size up to 6. As a result, it is necessary to
check location against MAX_HPO_DP2_ENCODERS.
Similiarly, disp_cfg_stream_location can be used as an array index which
should be 0..5, so the ASSERT's conditions should be less without equal.
No detection rules found.
No public exploits indexed.
2025-04-01
Published