{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-68184","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-12-16T13:41:40.252Z","datePublished":"2025-12-16T13:43:02.010Z","dateUpdated":"2026-08-05T12:10:07.452Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:10:07.452Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Disable AFBC support on Mediatek DRM driver\n\nCommit c410fa9b07c3 (\"drm/mediatek: Add AFBC support to Mediatek DRM\ndriver\") added AFBC support to Mediatek DRM and enabled the\n32x8/split/sparse modifier.\n\nHowever, this is currently broken on Mediatek MT8188 (Genio 700 EVK\nplatform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by\ndefault since Mesa v25.0.\n\nKernel trace reports vblank timeouts constantly, and the render is garbled:\n\n```\n[CRTC:62:crtc-0] vblank wait timed out\nWARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\n[...]\nHardware name: MediaTek Genio-700 EVK (DT)\nWorkqueue: events_unbound commit_work\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nlr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c\nsp : ffff80008337bca0\nx29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000\nx26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000\nx23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80\nx20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a\nx17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000\nx14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b\nx11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70\nx8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70\nx5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480\nCall trace:\n drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)\n drm_atomic_helper_commit_tail_rpm+0x64/0x80\n commit_tail+0xa4/0x1a4\n commit_work+0x14/0x20\n process_one_work+0x150/0x290\n worker_thread+0x2d0/0x3ec\n kthread+0x12c/0x210\n ret_from_fork+0x10/0x20\n---[ end trace 0000000000000000 ]---\n```\n\nUntil this gets fixed upstream, disable AFBC support on this platform, as\nit's currently broken with upstream Mesa."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Exploitation requires local access to the DRM device node (/dev/dri/card*) to create an AFBC framebuffer with DRM_IOCTL_MODE_ADDFB2 and commit it with DRM_IOCTL_MODE_ATOMIC/SETPLANE/PAGE_FLIP. There is no network or remote path into the MediaTek display pipeline.\nAC:L - On affected MT8188/MT8195-class hardware the failure is fully deterministic — the commit message reports vblank timeouts \"constantly\" — and the attacker supplies the AFBC modifier and framebuffer dimensions themselves. No race, no unpredictable memory layout, and no condition outside the attacker's control is involved.\nPR:L - An unprivileged local user in the graphical session (or any user able to open the card node and become DRM master when none is held) can perform the ADDFB2 + atomic commit; no root or CAP_SYS_ADMIN is needed. In practice Mesa >= 25.0 selects AFBC by default, so an ordinary unprivileged GL/compositor client reaches the broken path with no special effort.\nUI:N - The attacker issues the framebuffer-creation and atomic-commit ioctls directly from their own process. No victim action, file open, or mount is required.\nS:U - The corruption and the hang are confined to the kernel's own security authority — the DRM/display driver and the memory it DMAs from. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The driver uses plain drm_gem_fb_create() and never calls drm_gem_fb_afbc_init(), so only the linear min_size in drm_gem_fb_init_with_funcs() is validated while the OVL is programmed for the larger AFBC layout — an out-of-bounds DMA read of roughly w*h/16 bytes (~127 KB at 1080p) past the GEM object. Compounding this, the timed-out vblank wait lets drm_atomic_helper_cleanup_planes() release the buffer while the engine is still scanning it, so freed and reallocated kernel memory is decoded and rendered to the display.\nI:N - The AFBC path only programs the overlay engine to read from the framebuffer; there is no out-of-bounds or use-after-free write, and no kernel data structure is modified by the attacker. The observed garbled output is a consequence of the faulty reads, not of any memory corruption.\nA:H - Every AFBC commit stalls the events_unbound commit worker for the full 1000 ms wait_event_timeout in drm_atomic_helper_wait_for_vblanks() and triggers a WARN(), which is an immediate kernel panic on panic_on_warn systems and a repeating splat flood otherwise. The display pipeline is left effectively hung with garbled output, and the buffer is freed out from under the still-active DMA engine."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/mediatek/mtk_plane.c"],"versions":[{"version":"c410fa9b07c32cc69968ec83a148366d16c76dc4","lessThan":"df1ad5de2197ea1b527d13ae7b699e9ee7d724d4","status":"affected","versionType":"git"},{"version":"c410fa9b07c32cc69968ec83a148366d16c76dc4","lessThan":"0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17","status":"affected","versionType":"git"},{"version":"c410fa9b07c32cc69968ec83a148366d16c76dc4","lessThan":"72223700b620885d556a4c52a63f5294316176c6","status":"affected","versionType":"git"},{"version":"c410fa9b07c32cc69968ec83a148366d16c76dc4","lessThan":"9882a40640036d5bbc590426a78981526d4f2345","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/gpu/drm/mediatek/mtk_plane.c"],"versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","status":"unaffected","versionType":"semver"},{"version":"6.6.117","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.58","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.8","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.117"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12.58"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.17.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.18"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/df1ad5de2197ea1b527d13ae7b699e9ee7d724d4"},{"url":"https://git.kernel.org/stable/c/0eaa0a3dfe218c4cf1a0782ccbbc9e3931718f17"},{"url":"https://git.kernel.org/stable/c/72223700b620885d556a4c52a63f5294316176c6"},{"url":"https://git.kernel.org/stable/c/9882a40640036d5bbc590426a78981526d4f2345"}],"title":"drm/mediatek: Disable AFBC support on Mediatek DRM driver","x_generator":{"engine":"bippy-1.2.0"}}}}