CVE-2025-39807

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39807
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39807.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-39807
Downstream
BELL (1)
DEBIAN (1)
openSUSE (1)
ROOT (1)
SUSE (7)
UBUNTU (1)
Related
openSUSE (1)
SUSE (7)
Published
2025-09-16T13:00:10Z
Modified
2026-10-20T10:31:14Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
drm/mediatek: Add error handling for old state CRTC in atomic_disable
Details

In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Add error handling for old state CRTC in atomic_disable

Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL old_state->crtc.

E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188

Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39807.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
40b5b4ba8ed87c0bfb6268c10589777652ebde4c
Fixed
7d5cc22efa44e0fe321ce195c71c3d7da211fbb2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d208261e9f7c66960587b10473081dc1cecbe50b
Fixed
9a94e9d8b50bcfe89693bc899a54d3866d86e973
Fixed
0c6b24d70da21201ed009a2aca740d2dfddc7ab5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.40
Fixed
6.12.45
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.15.8
Fixed
6.16
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
a9c482689051ca96f4a4630fe49fd6919694caaa

Affected versions

v6.*
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.15.10
v6.15.11
v6.15.8
v6.15.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39807.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.45
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.16.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39807.json"