CVE-2025-40316 drm/mediatek: Fix device use-after-free on unbind
A use-after-free vulnerability in the Linux kernel's MediaTek DRM driver allows local attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-40316?
CVE-2025-40316 is an use after free vulnerability in Linux, published on 8 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Fix device use-after-free on unbind
A recent change fixed device reference leaks when looking up drm platform device driver data during bind() but failed to remove a partial fix which had been added by commit 80805b62ea5b ("drm/mediatek: Fix kobject put for component sub-drivers").
This results in a reference imbalance on component bind() failures and on unbind() which could lead to a user-after-free.
Make sure to only drop the references after retrieving the driver data by effectively reverting the previous partial fix.
Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.
Which versions are affected by CVE-2025-40316?
How do I fix CVE-2025-40316?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-40316 being exploited?
There is no known exploitation of CVE-2025-40316 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2025-40316, DEBIAN-CVE-2025-40316, GHSA-wh68-8742-rwwq, ROOT-OS-DEBIAN-13-CVE-2025-40316, UBUNTU-CVE-2025-40316.