CVE-2025-38467 drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
A race condition in the Exynos DRM driver causes a kernel panic during boot if a secondary console is present, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38467?
CVE-2025-38467 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling
If there's support for another console device (such as a TTY serial), the kernel occasionally panics during boot. The panic message and a relevant snippet of the call stack is as follows:
Unable to handle kernel NULL pointer dereference at virtual address 000000000000000 Call trace: drm_crtc_handle_vblank+0x10/0x30 (P) decon_irq_handler+0x88/0xb4 [...]
Otherwise, the panics don't happen. This indicates that it's some sort of race condition.
Add a check to validate if the drm device can handle vblanks before calling drm_crtc_handle_vblank() to avoid this.
Weakness: CWE-476
Which versions are affected by CVE-2025-38467?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2025-38467?
Apply the vendor's patch.
Is CVE-2025-38467 being exploited?
There is no known exploitation of CVE-2025-38467 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-65801, BELL-CVE-2025-38467, DEBIAN-CVE-2025-38467, GHSA-v57w-fx8g-p4v2, ROOT-OS-DEBIAN-11-CVE-2025-38467, ROOT-OS-DEBIAN-12-CVE-2025-38467 and 3 more.