drm/msm: Do not validate SSPP when it is not ready

{
  "id": "dc272d6d2e92b1b4f329791f2177d2a170321f1b52a2382ecde6347deb83f122",
  "url": "https://osv.dev/vulnerability/CVE-2025-40073",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "drm/msm: Do not validate SSPP when it is not ready",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: drm/msm: Do not validate SSPP when it is not ready Current code will validate current plane and previous plane to confirm they can share a SSPP with multi-rect mode. The SSPP is already allocated for previous plane, while current plane is not associated with any SSPP yet. Null pointer is referenced when validating the SSPP of current plane. Skip SSPP validation for current plane. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000888ac3000 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 4 UID: 0 PID: 1891 Comm: modetest Tainted: G S 6.15.0-rc2-g3ee3f6e1202e #335 PREEMPT Tainted: [S]=CPU_OUT_OF_SPEC Hardware name: SM8650 EV1 rev1 4slam 2et (DT) pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : dpu_plane_is_multirect_capable+0x68/0x90 lr : dpu_assign_plane_resources+0x288/0x410 sp : ffff800093dcb770 x29: ffff800093dcb770 x28: 0000000000002000 x27: ffff000817c6c000 x26: ffff000806b46368 x25: ffff0008013f6080 x24: ffff00080cbf4800 x2",
    "evidence": "osv:CVE-2025-40073",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.17.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-40073",
      "aliases": [
        "CVE-2025-40073"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "3ed12a3664b362e3462cca61d41f9a9460c9e260"
                },
                {
                  "fixed": "f1dbb3eedb7db4cad45d2619edb1cce6041f79e3"
                },
                {
                  "fixed": "6fc616723bb5fd4289d7422fa013da062b44ae55"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40073.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.16.0"
                },
                {
                  "fixed": "6.17.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40073.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.335273333Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/6fc616723bb5fd4289d7422fa013da062b44ae55",
        "https://git.kernel.org/stable/c/f1dbb3eedb7db4cad45d2619edb1cce6041f79e3",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40073.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-40073",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40073.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-40073",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 518986,
  "published_at": "2025-10-28T11:48:40.588+00:00"
}