Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2025-68184

Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/12/2025
Última modificación:
16/12/2025

Descripción

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/mediatek: Disable AFBC support on Mediatek DRM driver<br /> <br /> Commit c410fa9b07c3 ("drm/mediatek: Add AFBC support to Mediatek DRM<br /> driver") added AFBC support to Mediatek DRM and enabled the<br /> 32x8/split/sparse modifier.<br /> <br /> However, this is currently broken on Mediatek MT8188 (Genio 700 EVK<br /> platform); tested using upstream Kernel and Mesa (v25.2.1), AFBC is used by<br /> default since Mesa v25.0.<br /> <br /> Kernel trace reports vblank timeouts constantly, and the render is garbled:<br /> <br /> ```<br /> [CRTC:62:crtc-0] vblank wait timed out<br /> WARNING: CPU: 7 PID: 70 at drivers/gpu/drm/drm_atomic_helper.c:1835 drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c<br /> [...]<br /> Hardware name: MediaTek Genio-700 EVK (DT)<br /> Workqueue: events_unbound commit_work<br /> pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c<br /> lr : drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c<br /> sp : ffff80008337bca0<br /> x29: ffff80008337bcd0 x28: 0000000000000061 x27: 0000000000000000<br /> x26: 0000000000000001 x25: 0000000000000000 x24: ffff0000c9dcc000<br /> x23: 0000000000000001 x22: 0000000000000000 x21: ffff0000c66f2f80<br /> x20: ffff0000c0d7d880 x19: 0000000000000000 x18: 000000000000000a<br /> x17: 000000040044ffff x16: 005000f2b5503510 x15: 0000000000000000<br /> x14: 0000000000000000 x13: 74756f2064656d69 x12: 742074696177206b<br /> x11: 0000000000000058 x10: 0000000000000018 x9 : ffff800082396a70<br /> x8 : 0000000000057fa8 x7 : 0000000000000cce x6 : ffff8000823eea70<br /> x5 : ffff0001fef5f408 x4 : ffff80017ccee000 x3 : ffff0000c12cb480<br /> x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c12cb480<br /> Call trace:<br /> drm_atomic_helper_wait_for_vblanks.part.0+0x24c/0x27c (P)<br /> drm_atomic_helper_commit_tail_rpm+0x64/0x80<br /> commit_tail+0xa4/0x1a4<br /> commit_work+0x14/0x20<br /> process_one_work+0x150/0x290<br /> worker_thread+0x2d0/0x3ec<br /> kthread+0x12c/0x210<br /> ret_from_fork+0x10/0x20<br /> ---[ end trace 0000000000000000 ]---<br /> ```<br /> <br /> Until this gets fixed upstream, disable AFBC support on this platform, as<br /> it&amp;#39;s currently broken with upstream Mesa.

Impacto