CVE-2025-38362 drm/amd/display: Add null pointer check for get_first_active_display()
A missing null pointer check in the AMD display driver can cause a kernel crash when enabling HDCP encryption with no active displays.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38362?
CVE-2025-38362 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add null pointer check for get_first_active_display()
The function mod_hdcp_hdcp1_enable_encryption() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference in mod_hdcp_hdcp2_enable_encryption().
Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null.
Weakness: CWE-476
Which versions are affected by CVE-2025-38362?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38362?
Apply the vendor's patch.
Is CVE-2025-38362 being exploited?
There is no known exploitation of CVE-2025-38362 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-72596, BELL-CVE-2025-38362, DEBIAN-CVE-2025-38362, GHSA-m2wh-w7w6-m2cj, ROOT-OS-DEBIAN-11-CVE-2025-38362, ROOT-OS-DEBIAN-12-CVE-2025-38362 and 3 more.