CVE-2025-38240

Severity CVSS v4.0:
Pending analysis
Type:
CWE-476 NULL Pointer Dereference
Publication date:
18/04/2025
Last modified:
06/11/2025

Description

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/mediatek: dp: drm_err =&gt; dev_err in HPD path to avoid NULL ptr<br /> <br /> The function mtk_dp_wait_hpd_asserted() may be called before the<br /> `mtk_dp-&gt;drm_dev` pointer is assigned in mtk_dp_bridge_attach().<br /> Specifically it can be called via this callpath:<br /> - mtk_edp_wait_hpd_asserted<br /> - [panel probe]<br /> - dp_aux_ep_probe<br /> <br /> Using "drm" level prints anywhere in this callpath causes a NULL<br /> pointer dereference. Change the error message directly in<br /> mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the<br /> error messages in mtk_dp_parse_capabilities(), which is called by<br /> mtk_dp_wait_hpd_asserted().<br /> <br /> While touching these prints, also add the error code to them to make<br /> future debugging easier.

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.6 (including) 6.6.87 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.7 (including) 6.12.23 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.13 (including) 6.13.11 (excluding)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 6.14 (including) 6.14.2 (excluding)