Skip to content
Heist/ feed
Back to feed
HighFix available

drm/amd/display: Fix out-of-bound accesses

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.

Products
Kernel
Affected versions
Not specified
Fixed versions
6.12.20, 6.13.8
CVEs
CVE-2025-21985
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 18:24 UTC · Revision 1

Source evidence

drm/amd/display: Fix out-of-bound accesses

core-osv · Original source

Published 1 Apr 2025, 15:47 UTC

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.

osv:CVE-2025-21985

Kernel

Fixed versions: 6.12.20, 6.13.8

Complete source record
{
  "id": "eeaef6260aaeff25c1e6539e16d85a685d5ce458956930c66c2cae68a2b77d49",
  "url": "https://osv.dev/vulnerability/CVE-2025-21985",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "drm/amd/display: Fix out-of-bound accesses",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bound accesses [WHAT & HOW] hpo_stream_to_link_encoder_mapping has size MAX_HPO_DP2_ENCODERS(=4), but location can have size up to 6. As a result, it is necessary to check location against MAX_HPO_DP2_ENCODERS. Similiarly, disp_cfg_stream_location can be used as an array index which should be 0..5, so the ASSERT's conditions should be less without equal.",
    "evidence": "osv:CVE-2025-21985",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.12.20",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.13.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-21985",
      "aliases": [
        "CVE-2025-21985"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c"
                },
                {
                  "fixed": "36793d90d76f667d26c6dd025571481ee0c96abc"
                },
                {
                  "fixed": "9aedc776b11038f04f4641241bb7e877781e4aa4"
                },
                {
                  "fixed": "8adbb2a98b00926315fd513b5fe2596b5716b82d"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21985.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.15.0"
                },
                {
                  "fixed": "6.12.20"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.13.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21985.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:31.489666012Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/36793d90d76f667d26c6dd025571481ee0c96abc",
        "https://git.kernel.org/stable/c/8adbb2a98b00926315fd513b5fe2596b5716b82d",
        "https://git.kernel.org/stable/c/9aedc776b11038f04f4641241bb7e877781e4aa4",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21985.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-21985",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21985.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-21985",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 498378,
  "published_at": "2025-04-01T15:47:12.103+00:00"
}