In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Add error handling for old state CRTC in atomic_disable
Introduce error handling to address an issue where, after a hotplug
event, the cursor continues to update. This situation can lead to a
kernel panic due to accessing the NULL old_state->crtc.
E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtkcrtcplanedisable+0x24/0x140 mtkplaneatomicupdate+0x8c/0xa8 drmatomichelpercommitplanes+0x114/0x2c8 drmatomichelpercommittailrpm+0x4c/0x158 committail+0xa0/0x168 drmatomichelpercommit+0x110/0x120 drmatomiccommit+0x8c/0xe0 drmatomichelperupdateplane+0xd4/0x128 _setplaneatomic+0xcc/0x110 drmmodecursorcommon+0x250/0x440 drmmodecursorioctl+0x44/0x70 drmioctl+0x264/0x5d8 _arm64sysioctl+0xd8/0x510 invokesyscall+0x6c/0xe0 doel0svc+0x68/0xe8 el0svc+0x34/0x60 el0t64synchandler+0x1c/0xf8 el0t64sync+0x180/0x188
Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c6b24d70da21201ed009a2aca740d2dfddc7ab5",
"deprecated": false,
"id": "CVE-2025-39807-6b5c3a48",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"228874202148162336016530522789499583699",
"232766710554141636874058308428325230388",
"235885261877976860996901886129347359850",
"180459824287352054770852216403130216632"
]
},
"target": {
"file": "drivers/gpu/drm/mediatek/mtk_plane.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c6b24d70da21201ed009a2aca740d2dfddc7ab5",
"deprecated": false,
"id": "CVE-2025-39807-7445dd01",
"signature_type": "Function",
"digest": {
"length": 294.0,
"function_hash": "131218495229790413402409300571258419741"
},
"target": {
"function": "mtk_plane_atomic_disable",
"file": "drivers/gpu/drm/mediatek/mtk_plane.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d5cc22efa44e0fe321ce195c71c3d7da211fbb2",
"deprecated": false,
"id": "CVE-2025-39807-a0de8239",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"228874202148162336016530522789499583699",
"232766710554141636874058308428325230388",
"235885261877976860996901886129347359850",
"180459824287352054770852216403130216632"
]
},
"target": {
"file": "drivers/gpu/drm/mediatek/mtk_plane.c"
}
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7d5cc22efa44e0fe321ce195c71c3d7da211fbb2",
"deprecated": false,
"id": "CVE-2025-39807-b1f43765",
"signature_type": "Function",
"digest": {
"length": 294.0,
"function_hash": "131218495229790413402409300571258419741"
},
"target": {
"function": "mtk_plane_atomic_disable",
"file": "drivers/gpu/drm/mediatek/mtk_plane.c"
}
}
]