CVE-2025-71141: Linux Kernel DRM TILCDC Probe Vulnerability

CVE-2025-71141 Overview

A vulnerability has been identified in the Linux kernel's drm/tilcdc driver where improper cleanup functions are called unconditionally during failed probe scenarios. The drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helper functions are invoked in tilcdc_fini() regardless of whether the device was successfully registered, causing kernel warnings during probe deferral scenarios.

Critical Impact

This vulnerability can cause kernel warnings and potential system instability when the tilcdc driver encounters probe deferral scenarios, affecting embedded Linux systems using TI LCDC display controllers.

Affected Products

• Linux kernel with drm/tilcdc driver enabled
• Embedded systems using TI LCDC display controllers
• ARM-based platforms utilizing the tilcdc graphics subsystem

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-71141 published to NVD
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2025-71141

Vulnerability Analysis

This vulnerability exists within the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically in the tilcdc driver used for Texas Instruments LCD Controller devices. The issue arises from improper error handling during the device probe phase.

When the tilcdc_pdev_probe() function fails, it calls tilcdc_fini() for cleanup. However, tilcdc_fini() unconditionally invokes drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown(), even when the device has not been successfully registered. This violates the expected preconditions for these helper functions, which should only operate on properly initialized and registered devices.

The vulnerability manifests as kernel warnings originating from drm_atomic_helper_crtc_duplicate_state() when drm_atomic_helper_shutdown() attempts to operate on a CRTC that was never properly initialized. The warning trace shows the call chain starting from tilcdc_fini() through drm_atomic_helper_shutdown(), drm_atomic_helper_disable_all(), drm_atomic_get_crtc_state(), and finally to drm_atomic_helper_crtc_duplicate_state().

Root Cause

The root cause is the absence of proper goto-based error handling in the tilcdc_pdev_probe() function. The cleanup code in tilcdc_fini() does not distinguish between a fully initialized device and a partially initialized one from a failed probe. The previous implementation relied on an is_registered flag that was insufficient to prevent the premature invocation of DRM helper functions on uninitialized resources.

Attack Vector

This vulnerability is primarily a reliability and stability issue rather than a direct security exploit vector. The condition is triggered during probe deferral scenarios, which occur when:

• Required resources (such as GPIO, clock, or regulator dependencies) are not yet available
• The driver initialization is retried after dependencies become available
• System boot sequences where devices initialize in non-deterministic order

While not directly exploitable for code execution, the resulting kernel warnings and potential system instability could be leveraged as part of a denial-of-service condition on affected embedded systems. The vulnerability requires local access and specific hardware configurations to trigger.

Detection Methods for CVE-2025-71141

Indicators of Compromise

• Kernel warning messages containing drm_atomic_helper_crtc_duplicate_state in dmesg logs
• Warnings originating from drivers/gpu/drm/drm_atomic_state_helper.c:175
• Call traces showing tilcdc_fini invoked from tilcdc_pdev_probe
• System instability on ARM-based platforms with TI LCDC controllers during boot

Detection Strategies

• Monitor kernel logs (dmesg) for WARNING entries related to drm/tilcdc driver
• Implement automated log analysis for patterns matching drm_atomic_helper_shutdown from tilcdc_fini
• Audit systems running Linux kernels with the tilcdc module enabled
• Review boot logs on embedded systems using TI display controllers for probe deferral warnings

Monitoring Recommendations

• Enable kernel logging with sufficient verbosity to capture WARNING-level messages
• Set up alerting for recurring kernel warnings during system boot sequences
• Monitor embedded system health metrics for unexpected reboots or display initialization failures
• Implement regular kernel log collection on affected embedded Linux deployments

How to Mitigate CVE-2025-71141

Immediate Actions Required

• Apply the official kernel patches from the Linux kernel stable tree
• Update to a patched kernel version containing the fix
• Review embedded system deployments using TI LCDC controllers for vulnerability exposure
• Consider disabling the tilcdc module if not required until patching is complete

Patch Information

The vulnerability has been addressed through patches available in the Linux kernel stable tree. The fix rewrites the failed probe cleanup path using the standard goto error handling pattern, ensuring that cleanup functions (drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown()) are only called on successfully initialized resources. The unnecessary is_registered flag has been removed as part of this cleanup.

Patches are available at the following kernel.org commits:

• Kernel.org Commit Update
• Kernel.org Commit Change
• Kernel.org Commit Revision

Workarounds

• Blacklist the tilcdc kernel module on systems where it is not required: add blacklist tilcdc to /etc/modprobe.d/blacklist.conf
• If the display controller is required, ensure all driver dependencies are available before probe to minimize deferral scenarios
• Consider using a device tree overlay to ensure proper initialization order of dependencies
• Monitor affected systems closely for kernel warnings until the official patch can be applied

# Configuration example
# Blacklist tilcdc module until patch is applied
echo "blacklist tilcdc" | sudo tee /etc/modprobe.d/tilcdc-blacklist.conf

# Verify current kernel version
uname -r

# Check if tilcdc module is loaded
lsmod | grep tilcdc

# Unload tilcdc module if not in use
sudo modprobe -r tilcdc