PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71305 Linux CVE debrief

A vulnerability in the Linux kernel's DisplayPort Multi-Stream Transport (MST) driver could cause undefined behavior when releasing display timeslots. The issue occurs when a DP 2.1 monitor disconnects, causing the Virtual Channel Payload Identifier (VCPI) to become zero. The code then attempts to calculate a payload mask using a negative bit shift (`~BIT(vcpi - 1)`), triggering a UBSAN shift-out-of-bounds error. The fix adds a guard to skip payload mask modification when VCPI is zero, as VCPI should never legitimately be zero in this context. This is a kernel driver bug affecting display subsystem stability, not a security vulnerability exploitable for privilege escalation or code execution.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators running kernels with DisplayPort MST displays; kernel maintainers backporting stable fixes

Technical summary

The vulnerability exists in drivers/gpu/drm/display/drm_dp_mst_topology.c in the drm_dp_atomic_release_time_slots() function. When releasing MST timeslots, if delayed_destroy_work executes after a DP 2.1 monitor disconnect, vcpi can become 0. The code then computes payload = ~BIT(vcpi - 1), resulting in BIT(-1) which is undefined behavior detected by UBSAN. The fix adds a conditional check to skip payload mask updates when vcpi == 0. Affected call chain: drm_dp_delayed_destroy_work → drm_kms_helper_hotplug_event → drm_client_dev_hotplug → drm_fb_helper_hotplug_event → __drm_fb_helper_restore_fbdev_mode_unlocked → drm_client_modeset_commit → mst_connector_atomic_check → drm_dp_atomic_release_time_slots.

Defensive priority

low

Recommended defensive actions

  • Apply stable kernel updates containing the fix commits when available from your distribution
  • Monitor kernel logs for UBSAN warnings in drm_dp_mst_topology.c as indicators of this code path being exercised
  • No immediate action required for security hardening; this is a stability fix for display driver edge case

Evidence notes

CVE description confirms kernel fix with UBSAN stack trace showing shift exponent -1 in drm_dp_atomic_release_time_slots(). Six stable kernel commits provided across affected versions. No CVSS score assigned; NVD status 'Awaiting Analysis'.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71305 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71305

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71305 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71305

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/342ccffd9f77fc29fe1c05fd145e4d842bd2feaa

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3f44cdb5371faf225af37d5caba8f21ec0572469

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4d2ccdea18b564e3f73e3e543854acea64e6277d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/95dbd525efce2a9e9e1c50ad15213de644c85ad0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ac9a7c329a5610051fc476644c9b9145a5965ecb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.