CVE-2025-38597: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-19 · updated 2026-10-30
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available windows trying to find one designated as primary-plane and usable by that specific port. The code later wants to use drm_crtc_init_with_planes with that found primary plane, but nothing has checked so far if a primary plane was actually found. For whatever reason, the rk3576 vp2 does not have a usable primary window (if vp0 is also in use) which brought the issue to light and ended in a null-pointer dereference further down. As we expect a primary-plane to exist for a video-port, add a check at the end of the window-iteration and fail probing if none was found.

Affected products

Linux kernel: from 5.19 before 6.15.10; from 6.16 before 6.16.1 — fixed in 6.15.10, 6.16.1
Linux: 5.19 — fixed in 6.17

How to fix

Upgrade to a fixed version: Linux kernel 6.15.10, 6.16.1; Linux 6.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-38597 or the next vulnerability affects your stack