CVE-2025-21968 Overview
CVE-2025-21968 is a use-after-free vulnerability [CWE-416] in the Linux kernel's AMD display driver (drm/amd/display). The flaw resides in the High-bandwidth Digital Content Protection (HDCP) subsystem, where the property_validate_dwork delayed work queue continues executing after hdcp_work has been destroyed. A local, authenticated attacker can trigger the race to corrupt kernel slab memory. The issue affects Linux kernel 6.14 release candidates and earlier stable branches. Upstream maintainers resolved the flaw by cancelling the delayed work when the workqueue is destroyed.
Critical Impact
Local, low-privileged users can trigger slab memory corruption in the AMD GPU HDCP path, enabling potential privilege escalation, kernel information disclosure, or denial of service.
Affected Products
- Linux kernel stable branches prior to the fix commits
- Linux kernel 6.14-rc1 through 6.14-rc6
- Debian LTS distributions shipping vulnerable kernel builds
Discovery Timeline
- 2025-04-01 - CVE-2025-21968 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-21968
Vulnerability Analysis
The vulnerability lives in the AMD Display Core (DC) HDCP implementation within drivers/gpu/drm/amd/display/. HDCP state on AMD GPUs is managed by an hdcp_work structure that owns a delayed workqueue used to periodically validate HDCP link properties. This validation is scheduled through property_validate_dwork.
When the HDCP subsystem is torn down, the driver destroys the workqueue without first cancelling the pending delayed work. If property_validate_dwork fires after hdcp_work has already been freed, the work handler dereferences memory from the reclaimed slab allocation. KASAN reports this condition as a slab-use-after-free.
Root Cause
The root cause is an object lifetime bug: the delayed work item retains a pointer to hdcp_work beyond the object's lifetime. Destroying the workqueue does not synchronously cancel in-flight delayed work, so a scheduled callback can execute against freed memory. The fix explicitly calls cancel_delayed_work_sync() on property_validate_dwork before the workqueue and its owning structure are released.
Attack Vector
Exploitation requires local access with the ability to interact with the DRM/KMS interface exposed by the AMD GPU driver. An attacker with access to /dev/dri/* nodes can repeatedly trigger HDCP session setup and teardown to race the delayed work against the destroy path. Successful exploitation of a use-after-free in kernel slab memory can enable privilege escalation to root, kernel memory disclosure, or a kernel panic. No remote or unauthenticated attack path exists.
See the upstream fix commit for the specific code change.
Detection Methods for CVE-2025-21968
Indicators of Compromise
- KASAN kernel log entries reporting slab-use-after-free in amdgpu_dm_hdcp or property_validate_dwork call chains
- Unexpected kernel oops, general protection faults, or panics originating from drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c
- Repeated HDCP session churn from a non-privileged user process interacting with DRM ioctls
Detection Strategies
- Inventory running Linux kernel versions across the fleet and flag hosts on unpatched 6.14-rc or earlier stable builds with the AMD display driver loaded (lsmod | grep amdgpu).
- Enable KASAN on test and pre-production kernels to surface use-after-free conditions triggered by fuzzing DRM ioctls.
- Correlate dmesg and journald output for BUG: KASAN, Oops, or Call Trace events referencing hdcp_work or amdgpu_dm.
Monitoring Recommendations
- Ship kernel logs to a centralized log platform and alert on kernel crash signatures involving the amdgpu module.
- Monitor auditd for unusual process activity opening /dev/dri/card* and /dev/dri/renderD* from non-graphics user contexts.
- Track patch state of the seven upstream stable commits across Debian, Ubuntu, RHEL, and SUSE derivatives.
How to Mitigate CVE-2025-21968
Immediate Actions Required
- Apply the vendor-supplied kernel updates that include the cancel_delayed_work_sync() fix for property_validate_dwork.
- Prioritize patching on workstations, laptops, and virtual desktop hosts that use AMD GPUs with HDCP-capable displays.
- Restrict access to DRM device nodes to trusted local users where patching cannot be performed immediately.
Patch Information
The fix was backported across multiple stable trees. Reference commits: 06acfdef, 1397715b, 378b361e, 4964dbc4, 93d70106, bac7b8b1, and e65e7bea. See the Debian LTS advisory (msg00030) and Debian LTS advisory (msg00045) for distribution-specific packages. Rebuild custom kernels from a stable branch that includes the cherry-picked fix (upstream commit 725a04ba5a95e89c89633d4322430cfbca7ce128).
Workarounds
- Unload the amdgpu module on systems that do not require AMD graphics acceleration, using an alternate driver where feasible.
- Disable HDCP output on affected systems where content protection is not required, reducing exercise of the vulnerable code path.
- Enforce strict udev rules to limit /dev/dri/* access to members of the video or render groups only.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
