PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71305 Linux CVE debrief

A vulnerability in the Linux kernel's DisplayPort Multi-Stream Transport (MST) driver could cause undefined behavior when releasing display timeslots. The issue occurs when a DP 2.1 monitor disconnects, causing the Virtual Channel Payload Identifier (VCPI) to become zero. The code then attempts to calculate a payload mask using a negative bit shift (`~BIT(vcpi - 1)`), triggering a UBSAN shift-out-of-bounds error. The fix adds a guard to skip payload mask modification when VCPI is zero, as VCPI should never legitimately be zero in this context. This is a kernel driver bug affecting display subsystem stability, not a security vulnerability exploitable for privilege escalation or code execution.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with DisplayPort MST displays; kernel maintainers backporting stable fixes

Technical summary

The vulnerability exists in drivers/gpu/drm/display/drm_dp_mst_topology.c in the drm_dp_atomic_release_time_slots() function. When releasing MST timeslots, if delayed_destroy_work executes after a DP 2.1 monitor disconnect, vcpi can become 0. The code then computes payload = ~BIT(vcpi - 1), resulting in BIT(-1) which is undefined behavior detected by UBSAN. The fix adds a conditional check to skip payload mask updates when vcpi == 0. Affected call chain: drm_dp_delayed_destroy_work → drm_kms_helper_hotplug_event → drm_client_dev_hotplug → drm_fb_helper_hotplug_event → __drm_fb_helper_restore_fbdev_mode_unlocked → drm_client_modeset_commit → mst_connector_atomic_check → drm_dp_atomic_release_time_slots.

Defensive priority

low

Recommended defensive actions

  • Apply stable kernel updates containing the fix commits when available from your distribution
  • Monitor kernel logs for UBSAN warnings in drm_dp_mst_topology.c as indicators of this code path being exercised
  • No immediate action required for security hardening; this is a stability fix for display driver edge case

Evidence notes

CVE description confirms kernel fix with UBSAN stack trace showing shift exponent -1 in drm_dp_atomic_release_time_slots(). Six stable kernel commits provided across affected versions. No CVSS score assigned; NVD status 'Awaiting Analysis'.

Official resources

2026-05-27