CVE-2025-39882 (GCVE-0-2025-39882)
Vulnerability from cvelistv5
Published
2025-09-23 06:00
Modified
2026-08-05 12:05
Severity ?
8.4 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early. Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7d98166183d627c0b9daca7672b2191fae0f8a03
Version: 31ce7c089b50c3d3056c37e0e25e7535e4428ae1
Version: fae58d0155a979a8c414bbc12db09dd4b2f910d0
Version: 1f403699c40f0806a707a9a6eed3b8904224021a
 Create a notification for this product.
   Linux Linux Version: 6.6.105   ≤
Version: 6.12.45   ≤
Version: 6.16.5   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-39882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:25:43.286538Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:33:12.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d",
              "status": "affected",
              "version": "7d98166183d627c0b9daca7672b2191fae0f8a03",
              "versionType": "git"
            },
            {
              "lessThan": "b58a26cdd4795c1ce6a80e38e9348885555dacd6",
              "status": "affected",
              "version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1",
              "versionType": "git"
            },
            {
              "lessThan": "c4901802ed1ce859242e10af06e6a7752cba0497",
              "status": "affected",
              "version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0",
              "versionType": "git"
            },
            {
              "lessThan": "4de37a48b6b58faaded9eb765047cf0d8785ea18",
              "status": "affected",
              "version": "1f403699c40f0806a707a9a6eed3b8904224021a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/mediatek/mtk_drm_drv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.6.107",
              "status": "affected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.48",
              "status": "affected",
              "version": "6.12.45",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16.8",
              "status": "affected",
              "version": "6.16.5",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.107",
                  "versionStartIncluding": "6.6.105",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.48",
                  "versionStartIncluding": "6.12.45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.8",
                  "versionStartIncluding": "6.16.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: fix potential OF node use-after-free\n\nThe for_each_child_of_node() helper drops the reference it takes to each\nnode as it iterates over children and an explicit of_node_put() is only\nneeded when exiting the loop early.\n\nDrop the recently introduced bogus additional reference count decrement\nat each iteration that could potentially lead to a use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\nPR:N - No credential, capability, or namespace check exists anywhere on the path \u2014 the references are dropped by the kernel\u0027s own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev-\u003eof_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj-\u003ename` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\nA:H - Each boot produces \"ERROR: detected bad of_node_put()\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \u2014 an outright panic under `panic_on_warn` \u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:53.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497"
        },
        {
          "url": "https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18"
        }
      ],
      "title": "drm/mediatek: fix potential OF node use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39882",
    "datePublished": "2025-09-23T06:00:51.036Z",
    "dateReserved": "2025-04-16T07:20:57.144Z",
    "dateUpdated": "2026-08-05T12:05:53.126Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-39882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:25:43.286538Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:25:37.870Z\"}}], \"cna\": {\"title\": \"drm/mediatek: fix potential OF node use-after-free\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.4, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - `mtk_drm_get_all_drm_priv()` is reached only through the local driver model \\u2014 boot-time component bind from `mtk_drm_probe()`/`component_master_add_with_match()`, deferred-probe retries, sysfs bind/unbind of `mediatek-drm`, or module load/unload; there is no network, adjacent-network, or physical path, and leveraging the released `device_node` requires a local heap spray in the same kmalloc cache.\\nAC:L - The extra `of_node_put()` at the `next_put_node:` label is unconditional \\u2014 every path in the loop body falls through to it, so all 221 `/soc` children lose a reference on every single call, with no race to win and no memory-layout precondition. On mt8195/mt8188 (`mmsys_dev_num == 2`) the loop runs at least twice per boot, and bind/unbind cycles reproduce it deterministically at will.\\nPR:N - No credential, capability, or namespace check exists anywhere on the path \\u2014 the references are dropped by the kernel\u0027s own component-bind machinery at boot, before any user session exists, so the underflowed/released `device_node` state is reached with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not required for the vulnerable condition to arise (same basis as CVE-2025-39930 for this identical bug class).\\nUI:N - The MediaTek DRM component master binds automatically once its device-tree components probe, and deferred-probe retries run unattended at boot; no administrator, victim action, mount, or file open is needed for the extra `of_node_put()` to fire.\\nS:U - The corrupted `struct device_node`, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code executes in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a premature release/use-after-free of `device_node` objects that remain reachable through the OF tree, `dev-\u003eof_node`, and phandle lookups; `kobject_cleanup()` `kfree_const()`s `kobj-\u003ename` while leaving the pointer live, and once the slab is reclaimed `of_property_read_*()`, `%pOF` on `full_name`, and `kobject_name()` read back attacker-sprayed heap contents \\u2014 while the `bad of_node_put()` splat plus `dump_stack()` already leaks kernel pointers and a full stack trace.\\nI:H - A reclaimed `device_node` yields a control-flow hijack primitive via the embedded `fwnode_handle.ops` table dereferenced by `fwnode_call_int_op()` and via `kobj.ktype-\u003erelease` invoked on the next `of_node_put()`, and the `parent`/`child`/`sibling` links plus device-link `suppliers`/`consumers` list heads give arbitrary-write through list manipulation during tree operations.\\nA:H - Each boot produces \\\"ERROR: detected bad of_node_put()\\\" with `dump_stack()` followed by `refcount_t: underflow; use-after-free` WARNs \\u2014 an outright panic under `panic_on_warn` \\u2014 while `__kobject_del()` tears down `/sys/firmware/devicetree/base` entries and cascades puts onto the `/soc` node, and dereferencing a released node oopses the kernel with display bring-up failing outright.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"7d98166183d627c0b9daca7672b2191fae0f8a03\", \"lessThan\": \"b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"31ce7c089b50c3d3056c37e0e25e7535e4428ae1\", \"lessThan\": \"b58a26cdd4795c1ce6a80e38e9348885555dacd6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fae58d0155a979a8c414bbc12db09dd4b2f910d0\", \"lessThan\": \"c4901802ed1ce859242e10af06e6a7752cba0497\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1f403699c40f0806a707a9a6eed3b8904224021a\", \"lessThan\": \"4de37a48b6b58faaded9eb765047cf0d8785ea18\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6.105\", \"lessThan\": \"6.6.107\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.12.45\", \"lessThan\": \"6.12.48\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.16.5\", \"lessThan\": \"6.16.8\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/gpu/drm/mediatek/mtk_drm_drv.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/b2fbe0f9f80b9cfa1e06ddcf8b863d918394ef1d\"}, {\"url\": \"https://git.kernel.org/stable/c/b58a26cdd4795c1ce6a80e38e9348885555dacd6\"}, {\"url\": \"https://git.kernel.org/stable/c/c4901802ed1ce859242e10af06e6a7752cba0497\"}, {\"url\": \"https://git.kernel.org/stable/c/4de37a48b6b58faaded9eb765047cf0d8785ea18\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/mediatek: fix potential OF node use-after-free\\n\\nThe for_each_child_of_node() helper drops the reference it takes to each\\nnode as it iterates over children and an explicit of_node_put() is only\\nneeded when exiting the loop early.\\n\\nDrop the recently introduced bogus additional reference count decrement\\nat each iteration that could potentially lead to a use-after-free.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.107\", \"versionStartIncluding\": \"6.6.105\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.48\", \"versionStartIncluding\": \"6.12.45\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.16.8\", \"versionStartIncluding\": \"6.16.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:05:53.126Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-39882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T12:05:53.126Z\", \"dateReserved\": \"2025-04-16T07:20:57.144Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-23T06:00:51.036Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.