Security readout for executives and security teams
Plain-English summary
A flaw in the Linux AMD graphics driver can access memory after it has been freed when a USB-C dock is disconnected and reconnected. This can crash affected systems and may permit broader compromise under the supplied CVSS assessment. Exposure depends on the affected kernel, AMDGPU display support, HDCP activity, and dock use.
Executive priority
Prioritize timely remediation for exposed Linux workstations, especially frequently docked engineering or privileged-user endpoints. The 7.8 score and kernel-memory corruption justify high priority, but the evidence does not establish internet reachability or active exploitation. Use normal emergency procedures only if internal testing or vendor intelligence indicates greater exposure.
Technical view
The AMDGPU HDCP implementation retained amdgpu_dm_connector pointers without incrementing their reference counts. Disconnecting a USB-C dock can free those connector objects; reconnecting it can cause an asynchronous worker to dereference a dangling pointer, producing a slab use-after-free. The supplied record rates this CVSS 3.1 7.8: local, low complexity, low privileges, no user interaction.
Likely exposure
Most relevant to Linux endpoints using AMD graphics, the amdgpu display driver, HDCP, and hot-pluggable USB-C docks. The supplied affected-version data includes kernels from 5.5 and several later stable releases, but its flattened version list is ambiguous. Confirm status against the running distribution's advisory and kernel package changelog.
Exploitation context
The documented failure was reproduced by unplugging and reconnecting a USB-C dock, causing a kernel-worker memory access after free. The CVSS vector describes local, low-privilege attack conditions. The bundle reports that this CVE is not in KEV, and provides no evidence of active exploitation or a public exploit.
Researcher notes
The failure occurs in event_property_validate within amdgpu after connector destruction, with allocation and free paths involving DisplayPort MST connector management. The essential defect is missing kref ownership for copied connector pointers. The supplied record references fixes across multiple stable branches, but does not preserve enough range structure to map every vulnerable and fixed release confidently.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution security advisories before selecting a replacement kernel version.
- Prioritize affected workstations that regularly use USB-C docks and AMD graphics.
- If patching is delayed, reduce dock hot-plugging where operationally practical.
Validation and detection
- Record the running kernel version and distribution package release.
- Confirm AMDGPU display support and USB-C dock use on each candidate system.
- Compare package status with vendor advisories and the referenced stable commits.
- After updating, verify the running kernel is the patched package.
- Review kernel logs for KASAN, use-after-free, amdgpu, or connector-related failures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37903 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e25139c4aa5621f2db8e86688c33546cdd885e42CVE reference, Linux
- https://git.kernel.org/stable/c/bbc66abcd297be67e3d835276e21e6fdc65205a6CVE reference, Linux
- https://git.kernel.org/stable/c/dd329f04dda35a66e0c9ed462ba91bd5f2c8be70CVE reference, Linux
- https://git.kernel.org/stable/c/3a782a83d130ceac6c98a87639ddd89640bff486CVE reference, Linux
- https://git.kernel.org/stable/c/be593d9d91c5a3a363d456b9aceb71029aeb3f1dCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.