What’s Vulnerable › Vulnerabilities

CVE-2025-39934: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-04 · updated 2026-10-19
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ If the interrupt occurs before resource initialization is complete, the interrupt handler/worker may access uninitialized data such as the I2C tcpc_client device, potentially leading to NULL pointer dereference.

Affected products

• Linux kernel: from 5.11 before 5.15.194; from 5.16 before 6.1.154; from 6.2 before 6.6.108; from 6.7 before 6.12.49; from 6.13 before 6.16.9; 6.17-rc1, 6.17-rc2, 6.17-rc3, 6.17-rc4, 6.17-rc5, 6.17-rc6 — fixed in 5.15.194, 6.1.154, 6.12.49, 6.16.9, 6.6.108

How to fix

Upgrade to a fixed version: Linux kernel 5.15.194, 6.1.154, 6.12.49, 6.16.9. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0da73f7827691a5e2265b110d5fe12f29535ec92
• https://git.kernel.org/stable/c/15a77e1ab0a994d69b471c76b8d01117128dda26
• https://git.kernel.org/stable/c/1a7ea294d57fb61485d11b3f2241d631d73025cb
• https://git.kernel.org/stable/c/51a501e990a353a4f15da6bab295b28e5d118f64
• https://git.kernel.org/stable/c/a10f910c77f280327b481e77eab909934ec508f0
• https://git.kernel.org/stable/c/f9a089d0a6d537d0f2061c8a37a7de535ce0310e

Get alerted when CVE-2025-39934 or the next vulnerability affects your stack