LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21747: drm/ast: astdp: Fix timeout for enabling video signal

In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes takes up to 1 second for enabling the video signal, while the timeout is only 200 msec. This results in a kernel error message. Increase the timeout to 1 second. An example of the error message is shown below. [ 697.084433] ------------[ cut here ]------------ [ 697.091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled)) [ 697.091233] WARNING: CPU: 1 PID: 160 at drivers/gpu/drm/ast/ast_dp.c:232 ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.272469] RIP: 0010:ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.415283] Call Trace: [ 697.420727] <TASK> [ 697.425908] ? show_trace_log_lvl+0x196/0x2c0 [ 697.433304] ? show_trace_log_lvl+0x196/0x2c0 [ 697.440693] ? drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [ 697.450115] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.458059] ? __warn.cold+0xaf/0xca [ 697.464713] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.472633] ? report_bug+0x134/0x1d0 [ 697.479544] ? handle_bug+0x58/0x90 [ 697.486127] ? exc_invalid_op+0x13/0x40 [ 697.492975] ? asm_exc_invalid_op+0x16/0x20 [ 697.500224] ? preempt_count_sub+0x14/0xc0 [ 697.507473] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.515377] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.523227] drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [ 697.532388] drm_atomic_helper_commit_tail+0x58/0x90 [ 697.540400] ast_mode_config_helper_atomic_commit_tail+0x30/0x40 [ast] [ 697.550009] commit_tail+0xfe/0x1d0 [ 697.556547] drm_atomic_helper_commit+0x198/0x1c0 This is a cosmetical problem. Enabling the video signal still works even with the error message. The problem has always been present, but only recent versions of the ast driver warn about missing the timeout.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This CVE covers a Linux kernel graphics-driver timing bug in the AST DisplayPort path. Some hardware takes longer than expected to enable video, causing a kernel warning even though video still works. The upstream description calls it cosmetic, so business urgency is low unless warnings disrupt monitoring or operations.

Executive priority

Low. This is documented as a cosmetic Linux graphics-driver warning, not a security-impacting failure. Handle through normal kernel maintenance unless operational monitoring depends on clean kernel logs.

Technical view

In drm/ast ASTDP, the video-signal enable wait used a 200 ms timeout while the transmitter can require up to 1 second. Recent ast drivers warn when that timeout is missed. The fix increases the timeout to 1 second; no memory corruption, privilege impact, or data exposure is described.

Likely exposure

Exposure appears limited to Linux systems using the ast DRM driver with AST DisplayPort hardware on affected kernel builds. Servers with ASPEED display controllers may be relevant, but the sources do not identify specific distributions, appliances, or cloud images.

Exploitation context

No active exploitation is supported by the supplied sources, and the CVE is not marked KEV. The described behavior is a warning during display enablement, with video still functioning. No remote, local, or user-triggered exploitation path is documented in the bundle.

Researcher notes

The CVE record frames the issue as resolved by increasing a timeout in drivers/gpu/drm/ast/ast_dp.c. Evidence is narrow: it names the warning, behavior, and stable commits, but provides no CVSS, CWE, exploitability analysis, or distribution-specific affected matrices.

Mitigation direction

  • Apply the relevant Linux stable kernel update containing the referenced ast driver fix.
  • Track distribution advisories for backported kernels that include the timeout change.
  • Prioritize only where kernel warnings affect monitoring, supportability, or operational noise.
  • Avoid treating this as evidence of compromise without additional indicators.

Validation and detection

  • Check whether affected hosts load or build the ast DRM driver.
  • Identify kernel versions and vendor backport status against distribution advisories.
  • Review logs for ast_dp_set_enable or drm_WARN_ON messages during display initialization.
  • Confirm the referenced stable fix is present in the running kernel source or package notes.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21747 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4e29cc7c5c673299cfbaf4982fc8b6a72c9f706f, 4e29cc7c5c673299cfbaf4982fc8b6a72c9f706funaffected
LinuxLinux6.13, 0, 6.13.3, 6.14affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.