---
id: CVE-2025-71083
title: 'drm/ttm: Avoid NULL pointer deref for evicted BOs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/ttm: Avoid NULL pointer deref for evicted BOs

  It is possible for a BO to exist that is not currently associated with a
  resource, e.g. because it has been evicted.
  …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    47a85604a761005d255ae38115ee630cc6931756
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    4b9944493c6d92d7b29cfd83aaf3deb842b8da79
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    3d004f7341d4898889801ebb2ef61ffca610dd6f
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    5a81095d3e1b521ac7cfe3b14d5f149bace3d6e0
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    b94182b3d7228aec18d069cba56d5982e9bfe1b1
  - >-
    Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe <
    491adc6a0f9903c32b05f284df1148de39e8e644
  - Linux 4.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:40:29.583670Z'
published: '2026-01-13'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:15:11.431Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71083'
references:
  - url: 'https://git.kernel.org/stable/c/47a85604a761005d255ae38115ee630cc6931756'
  - url: 'https://git.kernel.org/stable/c/4b9944493c6d92d7b29cfd83aaf3deb842b8da79'
  - url: 'https://git.kernel.org/stable/c/3d004f7341d4898889801ebb2ef61ffca610dd6f'
  - url: 'https://git.kernel.org/stable/c/5a81095d3e1b521ac7cfe3b14d5f149bace3d6e0'
  - url: 'https://git.kernel.org/stable/c/b94182b3d7228aec18d069cba56d5982e9bfe1b1'
  - url: 'https://git.kernel.org/stable/c/491adc6a0f9903c32b05f284df1148de39e8e644'
tags:
  - cve.org
epss: 0.00137
epssPercentile: 0.02763
ingestedAt: '2026-10-19T18:35:50.138Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/ttm: Avoid NULL pointer deref for evicted BOs

It is possible for a BO to exist that is not currently associated with a
resource, e.g. because it has been evicted.

When devcoredump tries to read the contents of all BOs for dumping, we need
to expect this as well -- in this case, ENODATA is recorded instead of the
buffer contents.

## Affected

- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < 47a85604a761005d255ae38115ee630cc6931756`
- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < 4b9944493c6d92d7b29cfd83aaf3deb842b8da79`
- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < 3d004f7341d4898889801ebb2ef61ffca610dd6f`
- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < 5a81095d3e1b521ac7cfe3b14d5f149bace3d6e0`
- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < b94182b3d7228aec18d069cba56d5982e9bfe1b1`
- `Linux >= 09ac4fcb3f255e9225967c75f5893325c116cdbe < 491adc6a0f9903c32b05f284df1148de39e8e644`
- `Linux 4.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.