CVE-2025-39807
Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
16/09/2025
Última modificación:
16/09/2025
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
drm/mediatek: Add error handling for old state CRTC in atomic_disable<br />
<br />
Introduce error handling to address an issue where, after a hotplug<br />
event, the cursor continues to update. This situation can lead to a<br />
kernel panic due to accessing the NULL `old_state->crtc`.<br />
<br />
E,g.<br />
Unable to handle kernel NULL pointer dereference at virtual address<br />
Call trace:<br />
mtk_crtc_plane_disable+0x24/0x140<br />
mtk_plane_atomic_update+0x8c/0xa8<br />
drm_atomic_helper_commit_planes+0x114/0x2c8<br />
drm_atomic_helper_commit_tail_rpm+0x4c/0x158<br />
commit_tail+0xa0/0x168<br />
drm_atomic_helper_commit+0x110/0x120<br />
drm_atomic_commit+0x8c/0xe0<br />
drm_atomic_helper_update_plane+0xd4/0x128<br />
__setplane_atomic+0xcc/0x110<br />
drm_mode_cursor_common+0x250/0x440<br />
drm_mode_cursor_ioctl+0x44/0x70<br />
drm_ioctl+0x264/0x5d8<br />
__arm64_sys_ioctl+0xd8/0x510<br />
invoke_syscall+0x6c/0xe0<br />
do_el0_svc+0x68/0xe8<br />
el0_svc+0x34/0x60<br />
el0t_64_sync_handler+0x1c/0xf8<br />
el0t_64_sync+0x180/0x188<br />
<br />
Adding NULL pointer checks to ensure stability by preventing operations<br />
on an invalid CRTC state.