CVE-2025-71305
Description
A flaw was found in the Linux kernel's DisplayPort Multi-Stream Transport (MST) subsystem. When a DisplayPort 2.1 monitor is disconnected, a timing issue can cause the Virtual Channel Packet Interval (VCPI) value to become zero. Subsequent operations attempting to use this zero value in a bit shift can lead to a "shift-out-of-bounds" error, potentially resulting in system instability or a denial of service.
Statement
A shift-out-of-bounds condition in the DRM DisplayPort MST path can occur when delayed_destroy_work runs after a DP 2.1 monitor disconnect and payload vcpi becomes 0. The code then evaluates BIT(vcpi - 1), which creates a negative shift exponent and triggers UBSAN. For the CVSS the PR:N because physical hotplug triggering does not require an authenticated local user account, although it requires physical access to the display path. The issue is not network reachable and is tied to DisplayPort MST hotplug or disconnect behavior. Impact is mainly denial of service or display stack disruption, with higher availability impact only on systems where UBSAN or warning conditions can panic the kernel.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.2 | 5.5 | N/A |
| Attack Vector | Physical | Local | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: DoS: Crash, Exit, or Restart
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
