CVE-2025-39820 drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
A missing null pointer check in the Linux kernel's DPU encoder driver can cause a system crash when handling atomic state updates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39820?
CVE-2025-39820 is a medium-severity vulnerability in Linux kernel, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference.
This follows the same pattern used in dpu_encoder_update_topology() within the same file, which checks for NULL before using conn_state.
Patchwork: https://patchwork.freedesktop.org/patch/665188/
Weakness: CWE-476
Which versions are affected by CVE-2025-39820?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39820?
Apply the vendor's patch.
Is CVE-2025-39820 being exploited?
There is no known exploitation of CVE-2025-39820 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39820, DEBIAN-CVE-2025-39820, GHSA-2xr3-2r6g-cgx8, UBUNTU-CVE-2025-39820.