CVE-2025-40354

What it actually does

The dc->links[MAX_LINKS] array was sized smaller than the maximum requested connectors plus DPIA links plus virtual links, enabling out-of-bounds access; additionally hw_init() dereferences a NULL link->enc pointer for certain DPIA non-display endpoints.

Why it matters to the business

Unpatched systems risk kernel crashes or memory corruption that can lead to denial of service or local privilege escalation, disrupting workloads on affected Red Hat Enterprise Linux 7.6 compute nodes until kernels are updated.

How an attack unfolds

An attacker with local access triggers AMD display driver initialization or link configuration that requests more than 12 links, causing the undersized array to be exceeded or a NULL encoder to be accessed during hw_init for non-display DPIA endpoints.

How to fix it

Upgrade all listed packages to the fixed versions 0:3.10.0-957.54.1.el7 or later; reboot into the new kernel after installation.

How to confirm the fix worked

Verify installed kernel and related package versions match or exceed 0:3.10.0-957.54.1.el7; confirm the drm/amd/display changes from commit d7f5a61e1b04ed87b008c8d327649d184dc5bb45 are present in the running kernel source or binary.

Typical attack path

1. Obtain local shell on affected system
2. Trigger display or graphics subsystem initialization that enumerates maximum connectors and DPIA links
3. Cause dc->links array overrun or NULL link->enc dereference during hw_init
4. Achieve kernel panic, memory corruption, or escalation to ring 0

How to detect it

Review kernel logs for AMD display driver oops or NULL pointer dereference messages during boot or graphics initialization; inspect dmesg and journalctl for drm/amd/display stack traces referencing link or enc pointers.

What your security team should do

• Immediately schedule kernel updates to 0:3.10.0-957.54.1.el7 across all rhel_eus:7.6 compute nodes
• Prioritize systems with AMD GPUs or active display/DPIA configurations
• Test updates in staging before broad deployment to avoid boot or graphics regressions
• Monitor for post-update stability and re-scan for any remaining vulnerable package versions