CVE-2025-39807
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-16

Last updated on: 2025-12-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_state->crtc`. E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188 Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-16
Last Modified
2025-12-02
Generated
2026-06-16
AI Q&A
2025-09-16
EPSS Evaluated
2026-06-15
NVD
CVE-2025-39807
Affected Vendors & Products
Showing 8 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.12.40 (inc) to 6.12.45 (exc)
linux linux_kernel From 6.15.8 (inc) to 6.16 (exc)
linux linux_kernel From 6.16.1 (inc) to 6.16.5 (exc)
linux linux_kernel 6.16
linux linux_kernel 6.16
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's drm/mediatek component occurs because of missing error handling for an old CRTC state during atomic_disable. After a hotplug event, the cursor may continue to update, leading to a kernel panic caused by a NULL pointer dereference when accessing old_state->crtc. The fix involves adding NULL pointer checks to prevent operations on an invalid CRTC state, thereby improving system stability.

Impact Analysis

This vulnerability can cause a kernel panic, which results in a system crash or instability. This can disrupt normal operations, potentially causing data loss or downtime on affected systems using the Linux kernel with the drm/mediatek driver.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-39807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart