CVE-2025-39807: drm/mediatek: Add error handling for old state CRTC in atomic_disable
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Add error handling for old state CRTC in atomicdisable
Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL oldstate->crtc.
E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtkcrtcplanedisable+0x24/0x140 mtkplaneatomicupdate+0x8c/0xa8 drmatomichelpercommitplanes+0x114/0x2c8 drmatomichelpercommittailrpm+0x4c/0x158 committail+0xa0/0x168 drmatomichelpercommit+0x110/0x120 drmatomiccommit+0x8c/0xe0 drmatomichelperupdateplane+0xd4/0x128 setplaneatomic+0xcc/0x110 drmmodecursorcommon+0x250/0x440 drmmodecursorioctl+0x44/0x70 drmioctl+0x264/0x5d8 arm64sysioctl+0xd8/0x510 invokesyscall+0x6c/0xe0 doel0svc+0x68/0xe8 el0svc+0x34/0x60 el0t64synchandler+0x1c/0xf8 el0t64sync+0x180/0x188
Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39807?
The severity of CVE-2025-39807 is categorized as a moderate vulnerability impacting the Linux kernel.
How do I fix CVE-2025-39807?
To fix CVE-2025-39807, update to the latest Linux kernel version that includes the patch addressing this issue.
What systems are affected by CVE-2025-39807?
CVE-2025-39807 affects systems running the Linux kernel with the Mediatek DRM subsystem.
What details are known about the vulnerability CVE-2025-39807?
CVE-2025-39807 involves a flaw in error handling during atomic disable processes after a hotplug event.
Are there any known exploits for CVE-2025-39807?
As of now, there are no publicly known exploits for CVE-2025-39807.