CVE-2025-40316
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix device use-after-free on unbind
A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers").
This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free.
Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix.
Leer descripción completaMostrar menos
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-40316",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7d98166183d627c0b9daca7672b2191fae0f8a03",
"lessThan": "a5a896f8315de358a2932e2c23c42d550256046a",
"versionType": "git"
},
{
"status": "affected",
"version": "31ce7c089b50c3d3056c37e0e25e7535e4428ae1",
"lessThan": "0142fe895986addf35885b43440718e567121155",
"versionType": "git"
},
{
"status": "affected",
"version": "1f403699c40f0806a707a9a6eed3b8904224021a",
"lessThan": "8ba827e09eb586e952d10e39406fa02d10bb591e",
"versionType": "git"
},
{
"status": "affected",
"version": "1f403699c40f0806a707a9a6eed3b8904224021a",
"lessThan": "926d002e6d7e2f1fd5c1b53cf6208153ee7d380d",
"versionType": "git"
},
{
"status": "affected",
"version": "fae58d0155a979a8c414bbc12db09dd4b2f910d0",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.105",
"lessThan": "6.6.117",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.45",
"lessThan": "6.12.58",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.16.5",
"lessThan": "6.17",
"versionType": "semver"
}
],
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_drm_drv.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.17",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.117",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.58",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver",
"lessThanOrEqual": "6.17.*"
},
{
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_drm_drv.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2025-12-08T01:16:04.147",
"references": [
{
"url": "https://git.kernel.org/stable/c/0142fe895986addf35885b43440718e567121155",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8ba827e09eb586e952d10e39406fa02d10bb591e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/926d002e6d7e2f1fd5c1b53cf6208153ee7d380d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a5a896f8315de358a2932e2c23c42d550256046a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Deferred",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: Fix device use-after-free on unbind\n\nA recent change fixed device reference leaks when looking up drm\nplatform device driver data during bind() but failed to remove a partial\nfix which had been added by commit 80805b62ea5b (\"drm/mediatek: Fix\nkobject put for component sub-drivers\").\n\nThis results in a reference imbalance on component bind() failures and\non unbind() which could lead to a user-after-free.\n\nMake sure to only drop the references after retrieving the driver data\nby effectively reverting the previous partial fix.\n\nNote that holding a reference to a device does not prevent its driver\ndata from going away so there is no point in keeping the reference."
}
],
"lastModified": "2026-06-17T09:21:38.837",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}