CVE-2025-71305

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/display/dp_mst: Add protection against 0 vcpi

When releasing a timeslot there is a slight chance we may end up

with the wrong payload mask due to overflow if the delayed_destroy_work

ends up coming into play after a DP 2.1 monitor gets disconnected

which causes vcpi to become 0 then we try to make the payload =

~BIT(vcpi - 1) which is a negative shift. VCPI id should never

really be 0 hence skip changing the payload mask if VCPI is 0.

Otherwise it leads to

<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc

[drm_display_helper]] port ffff888126ce9000 (3)

<4> [515.287267] -----------[ cut here ]-----------

<3> [515.287268] UBSAN: shift-out-of-bounds in

../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36

<3> [515.287271] shift exponent -1 is negative

<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G

S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)

<4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References