{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39882", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.144Z", "datePublished": "2025-09-23T06:00:51.036Z", "dateUpdated": "2026-08-05T12:05:53.126Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:53.126Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model — boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional — every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path — the references are dropped by the kernel's own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev->of_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj->name` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents — while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype->release` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs — an outright panic under `panic_on_warn` — while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/mediatek/mtk_drm_drv.c" ], "versions": [ { "version": "7d98166183d627c0b9daca7672b2191fae0f8a03", "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d", "status": "affected", "versionType": "git" }, { "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1", "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6", "status": "affected", "versionType": "git" }, { "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0", "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497", "status": "affected", "versionType": "git" }, { "version": "1f403699c40f0806a707a9a6eed3b8904224021a", "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/gpu/drm/mediatek/mtk_drm_drv.c" ], "versions": [ { "version": "6.6.105", "lessThan": "6.6.107", "status": "affected", "versionType": "semver" }, { "version": "6.12.45", "lessThan": "6.12.48", "status": "affected", "versionType": "semver" }, { "version": "6.16.5", "lessThan": "6.16.8", "status": "affected", "versionType": "semver" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.105", "versionEndExcluding": "6.6.107" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.45", "versionEndExcluding": "6.12.48" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16.5", "versionEndExcluding": "6.16.8" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d" }, { "url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6" }, { "url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497" }, { "url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18" } ], "title": "drm/mediatek: fix potential OF node use-after-free", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-39882", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-01-14T19:25:43.286538Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T19:33:12.579Z" } } ] } }