CVE-2025-38240: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
First published: Fri Apr 18 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make future debugging easier.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/13ec849fd2eab808ee8eba2625df7ebea3b85edf
- https://git.kernel.org/stable/c/57a9fb47551b33cde7b76d17c0072c3b394f4620
- https://git.kernel.org/stable/c/2fda391ef7a701748abd7fa32232981b522c1e07
- https://git.kernel.org/stable/c/149a5c38436c229950cf1020992ce65c9549bc19
- https://git.kernel.org/stable/c/106a6de46cf4887d535018185ec528ce822d6d84
Frequently Asked Questions
What is the severity of CVE-2025-38240?
CVE-2025-38240 is considered a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2025-38240?
To fix CVE-2025-38240, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2025-38240?
CVE-2025-38240 affects the Linux kernel as it has a potential impact on devices utilizing this kernel.
What is the nature of CVE-2025-38240?
CVE-2025-38240 involves a null pointer dereference in the function mtk_dp_wait_hpd_asserted() in the Linux kernel's Direct Rendering Manager for MediaTek devices.
Is CVE-2025-38240 being actively exploited?
As of the last update, there is no public evidence suggesting that CVE-2025-38240 is actively being exploited in the wild.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/source
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/linux
- canonical/linux kernel