CVE-2025-39807: drm/mediatek: Add error handling for old state CRTC in atomic_disable

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-16 · updated 2026-10-19
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_state->crtc`. E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188 Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state.

Affected products

Linux kernel: from 6.12.40 before 6.12.45; from 6.15.8 before 6.16; from 6.16.1 before 6.16.5; 6.16, 6.16-rc7, 6.17-rc1, 6.17-rc2, 6.17-rc3 — fixed in 6.12.45, 6.16, 6.16.5

How to fix

Upgrade to a fixed version: Linux kernel 6.12.45, 6.16, 6.16.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-39807 or the next vulnerability affects your stack