CVE-2025-40316: drm/mediatek: Fix device use-after-free on unbind
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix device use-after-free on unbind
A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers").
This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free.
Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40316?
CVE-2025-40316 has been classified as a high-severity vulnerability due to its potential impact on system stability and security.
How does CVE-2025-40316 affect the Linux kernel?
CVE-2025-40316 affects the Linux kernel by allowing a use-after-free condition in the drm/mediatek subsystem, which can lead to memory corruption.
How do I fix CVE-2025-40316?
To fix CVE-2025-40316, users should apply the latest patches released by their Linux distribution that address this vulnerability.
Which versions of the Linux kernel are affected by CVE-2025-40316?
CVE-2025-40316 affects specific versions of the Linux kernel that include the vulnerable drm/mediatek implementation before the patch is applied.
What are the potential consequences of not mitigating CVE-2025-40316?
Failing to mitigate CVE-2025-40316 could lead to system crashes, data corruption, and increased risk of exploitation by attackers.