CVE-2025-39807 drm/mediatek: Add error handling for old state CRTC in atomic_disable
A missing NULL check in the Mediatek DRM driver causes a kernel panic during hotplug events, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39807?
CVE-2025-39807 is a medium-severity vulnerability in Linux kernel, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: Add error handling for old state CRTC in atomic_disable
Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_state->crtc`.
E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188
Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.
Weakness: CWE-476
Which versions are affected by CVE-2025-39807?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39807?
Apply the vendor's patch.
Is CVE-2025-39807 being exploited?
There is no known exploitation of CVE-2025-39807 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39807, DEBIAN-CVE-2025-39807, GHSA-4xc7-4q59-wfx3, ROOT-OS-DEBIAN-13-CVE-2025-39807, UBUNTU-CVE-2025-39807.