CVE-2025-38080

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The overflow is reached only through the local DRM atomic-commit/page-flip ioctl path on /dev/dri/cardN (amdgpu_dm_atomic_commit_tail → dc_update_planes_and_stream → commit_planes_for_stream_fast → hwss_build_fast_sequence). There is no network or adjacent-network exposure.

AC:LAttack complexity, low

There is no bounds check whatsoever in hwss_build_fast_sequence, so an attacker who submits an atomic commit with many planes in one MPC chain and multiple simultaneous update flags (address, gamma, CTM/out_csc, gamut remap, bias/scale) deterministically drives the step count past 50 on the widely-deployed 6-pipe DCN2.0/DCN3.0 ASICs. No race, timing window, or attacker-uncontrollable state is involved.

PR:LPrivileges required, low

Only an ordinary local user session is needed — logind grants the seat user rw access to /dev/dri/cardN and DRM master can be acquired on a free VT or by being the compositor, which is all the DRM_MASTER-gated atomic ioctl requires. No root or CAP_SYS_ADMIN is necessary.

UI:NUser interaction, none

The attacker issues the atomic commit itself; no action by another user or victim is required at any point in the path.

S:UScope, unchanged

The corruption is confined to kernel memory belonging to the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The first overflowing write clobbers block_sequence_steps with a kernel pointer, after which hwss_execute_sequence iterates an enormous count, reading out-of-bounds kernel memory as block_sequence entries and dereferencing OOB-derived pointers (mpc, pipe_ctx, csc regval) into display hardware programming — an out-of-bounds read/disclosure primitive, and the in-struct spill over kref refcount enables a dc_state use-after-free that can be leveraged for arbitrary read.

I:HIntegrity impact, high

This is an unbounded out-of-bounds write: entries 50+ overwrite block_sequence_steps, dc_dmub_cmd[], dmub_cmd_count and the kref refcount, and once the counter holds pointer-derived garbage every further write lands far outside the kvzalloc'd dc_state, giving a wild kernel-heap write usable for control-flow hijacking.

A:HAvailability impact, high

The commit message states outright that the overflow corrupts block_sequence_steps and causes a crash; the resulting wild writes and OOB function-pointer dispatch reliably produce a kernel oops/panic.